Merge master into staging-next

2025-01-26 18:04:05 +00:00
parent ac808b6b05 798f303659
commit 189081a8dc
140 changed files with 1669 additions and 700 deletions
@@ -6173,6 +6173,13 @@
    githubId = 20759788;
    name = "JP Lippold";
  };
+  DrakeTDL = {
+    name = "Drake";
+    email = "draketdl@mailbox.org";
+    matrix = "@draketdl:matrix.org";
+    github = "DrakeTDL";
+    githubId = 22124013;
+  };
  dramaturg = {
    email = "seb@ds.ag";
    github = "dramaturg";
@@ -115,6 +115,8 @@

 - [Zipline](https://zipline.diced.sh/), a ShareX/file upload server that is easy to use, packed with features, and with an easy setup. Available as [services.zipline](#opt-services.zipline.enable).

+- [Stash](https://github.com/stashapp/stash), An organizer for your adult videos/images, written in Go. Available as [services.stash](#opt-services.stash.enable).
+
 - [Fider](https://fider.io/), an open platform to collect and prioritize feedback. Available as [services.fider](#opt-services.fider.enable).

 - [mqtt-exporter](https://github.com/kpetremann/mqtt-exporter/), a Prometheus exporter for exposing messages from MQTT. Available as [services.prometheus.exporters.mqtt](#opt-services.prometheus.exporters.mqtt.enable).
@@ -1577,6 +1577,7 @@
  ./services/web-apps/snipe-it.nix
  ./services/web-apps/sogo.nix
  ./services/web-apps/stirling-pdf.nix
+  ./services/web-apps/stash.nix
  ./services/web-apps/trilium.nix
  ./services/web-apps/tt-rss.nix
  ./services/web-apps/vikunja.nix
@@ -18,7 +18,7 @@ To enable FoundationDB, add the following to your
 ```nix
 {
  services.foundationdb.enable = true;
-  services.foundationdb.package = pkgs.foundationdb73; # FoundationDB 7.r3.x
+  services.foundationdb.package = pkgs.foundationdb73; # FoundationDB 7.3.x
 }
 ```

@@ -84,14 +84,7 @@ let
          ++ filter (x: x != null) [
            cfg.${proto}.cert or null
            cfg.${proto}.key or null
-          ]
-          ++
-            # Without confinement the whole Nix store
-            # is made available to the service
-            optionals (!config.systemd.services."public-inbox-${srv}".confinement.enable) [
-              "${pkgs.dash}/bin/dash:/bin/sh"
-              builtins.storeDir
-            ];
+          ];
        # The following options are only for optimizing:
        # systemd-analyze security public-inbox-'*'
        AmbientCapabilities = "";
@@ -108,7 +101,7 @@ let
        ProtectHostname = true;
        ProtectKernelLogs = true;
        ProtectProc = "invisible";
-        #ProtectSystem = "strict";
+        ProtectSystem = "strict";
        RemoveIPC = true;
        RestrictAddressFamilies =
          [ "AF_UNIX" ]
@@ -130,28 +123,9 @@ let
          # Not removing @timer because git upload-pack needs it.
        ];
        SystemCallArchitectures = "native";
-
-        # The following options are redundant when confinement is enabled
-        RootDirectory = "/var/empty";
-        TemporaryFileSystem = "/";
-        PrivateMounts = true;
-        MountAPIVFS = true;
-        PrivateDevices = true;
-        PrivateTmp = true;
-        PrivateUsers = true;
-        ProtectControlGroups = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
      };
      confinement = {
-        # Until we agree upon doing it directly here in NixOS
-        # https://github.com/NixOS/nixpkgs/pull/104457#issuecomment-1115768447
-        # let the user choose to enable the confinement with:
-        # systemd.services.public-inbox-httpd.confinement.enable = true;
-        # systemd.services.public-inbox-imapd.confinement.enable = true;
-        # systemd.services.public-inbox-init.confinement.enable = true;
-        # systemd.services.public-inbox-nntpd.confinement.enable = true;
-        #enable = true;
+        enable = true;
        mode = "full-apivfs";
        # Inline::C needs a /bin/sh, and dash is enough
        binSh = "${pkgs.dash}/bin/dash";
@@ -0,0 +1,585 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  inherit (lib)
+    getExe
+    literalExpression
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    optionalString
+    toUpper
+    types
+    ;
+
+  cfg = config.services.stash;
+
+  stashType = types.submodule {
+    options = {
+      path = mkOption {
+        type = types.path;
+        description = "location of your media files";
+      };
+      excludevideo = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to exclude video files from being scanned into Stash";
+      };
+      excludeimage = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to exclude image files from being scanned into Stash";
+      };
+    };
+  };
+  stashBoxType = types.submodule {
+    options = {
+      name = mkOption {
+        type = types.str;
+        description = "The name of the Stash Box";
+      };
+      endpoint = mkOption {
+        type = types.str;
+        description = "URL to the Stash Box graphql api";
+      };
+      apikey = mkOption {
+        type = types.str;
+        description = "Stash Box API key";
+      };
+    };
+  };
+
+  recentlyReleased = mode: {
+    __typename = "CustomFilter";
+    message = {
+      id = "recently_released_objects";
+      values.objects = mode;
+    };
+    mode = toUpper mode;
+    sortBy = "date";
+    direction = "DESC";
+  };
+  recentlyAdded = mode: {
+    __typename = "CustomFilter";
+    message = {
+      id = "recently_added_objects";
+      values.objects = mode;
+    };
+    mode = toUpper mode;
+    sortBy = "created_at";
+    direction = "DESC";
+  };
+  uiPresets = {
+    recentlyReleasedScenes = recentlyReleased "Scenes";
+    recentlyAddedScenes = recentlyAdded "Scenes";
+    recentlyReleasedGalleries = recentlyReleased "Galleries";
+    recentlyAddedGalleries = recentlyAdded "Galleries";
+    recentlyAddedImages = recentlyAdded "Images";
+    recentlyReleasedMovies = recentlyReleased "Movies";
+    recentlyAddedMovies = recentlyAdded "Movies";
+    recentlyAddedStudios = recentlyAdded "Studios";
+    recentlyAddedPerformers = recentlyAdded "Performers";
+  };
+
+  settingsFormat = pkgs.formats.yaml { };
+  settingsFile = settingsFormat.generate "config.yml" cfg.settings;
+  settingsType = types.submodule {
+    freeformType = settingsFormat.type;
+
+    options = {
+      host = mkOption {
+        type = types.str;
+        default = "localhost";
+        example = "::1";
+        description = "The ip address that Stash should bind to.";
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 9999;
+        example = 1234;
+        description = "The port that Stash should listen on.";
+      };
+
+      stash = mkOption {
+        type = types.listOf stashType;
+        description = ''
+          Add directories containing your adult videos and images.
+          Stash will use these directories to find videos and/or images during scanning.
+        '';
+        example = literalExpression ''
+          {
+            stash = [
+              {
+                Path = "/media/drive/videos";
+                ExcludeImage = true;
+              }
+            ];
+          }
+        '';
+      };
+      stash_boxes = mkOption {
+        type = types.listOf stashBoxType;
+        default = [ ];
+        description = ''Stash-box facilitates automated tagging of scenes and performers based on fingerprints and filenames'';
+        example = literalExpression ''
+          {
+            stash_boxes = [
+              {
+                name = "StashDB";
+                endpoint = "https://stashdb.org/graphql";
+                apikey = "aaaaaaaaaaaa.bbbbbbbbbbbbbbbbbbbbbbbb.cccccccccccccc";
+              }
+            ];
+          }
+        '';
+      };
+      ui.frontPageContent = mkOption {
+        description = "Search filters to display on the front page.";
+        type = types.either (types.listOf types.attrs) (types.functionTo (types.listOf types.attrs));
+        default = presets: [
+          presets.recentlyReleasedScenes
+          presets.recentlyAddedStudios
+          presets.recentlyReleasedMovies
+          presets.recentlyAddedPerformers
+          presets.recentlyReleasedGalleries
+        ];
+        example = literalExpression ''
+          presets: [
+            # To get the savedFilterId, you can query `{ findSavedFilters(mode: <FilterMode>) { id name } }` on localhost:9999/graphql
+            {
+              __typename = "SavedFilter";
+              savedFilterId = 1;
+            }
+            # basic custom filter
+            {
+              __typename = "CustomFilter";
+              title = "Random Scenes";
+              mode = "SCENES";
+              sortBy = "random";
+              direction = "DESC";
+            }
+            presets.recentlyAddedImages
+          ]
+        '';
+        apply = type: if builtins.isFunction type then (type uiPresets) else type;
+      };
+      blobs_path = mkOption {
+        type = types.path;
+        default = "${cfg.dataDir}/blobs";
+        description = "Path to blobs";
+      };
+      cache = mkOption {
+        type = types.path;
+        default = "${cfg.dataDir}/cache";
+        description = "Path to cache";
+      };
+      database = mkOption {
+        type = types.path;
+        default = "${cfg.dataDir}/go.sqlite";
+        description = "Path to the SQLite database";
+      };
+      generated = mkOption {
+        type = types.path;
+        default = "${cfg.dataDir}/generated";
+        description = "Path to generated files";
+      };
+      plugins_path = mkOption {
+        type = types.path;
+        default = "${cfg.dataDir}/plugins";
+        description = "Path to scrapers";
+      };
+      scrapers_path = mkOption {
+        type = types.path;
+        default = "${cfg.dataDir}/scrapers";
+        description = "Path to scrapers";
+      };
+
+      blobs_storage = mkOption {
+        type = types.enum [
+          "FILESYSTEM"
+          "DATABASE"
+        ];
+        default = "FILESYSTEM";
+        description = "Where to store blobs";
+      };
+      calculate_md5 = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to calculate MD5 checksums for scene video files";
+      };
+      create_image_clip_from_videos = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Create Image Clips from Video extensions when Videos are disabled in Library";
+      };
+      dangerous_allow_public_without_auth = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Learn more at https://docs.stashapp.cc/networking/authentication-required-when-accessing-stash-from-the-internet/";
+      };
+      gallery_cover_regex = mkOption {
+        type = types.str;
+        default = "(poster|cover|folder|board)\.[^\.]+$";
+        description = "Regex used to identify images as gallery covers";
+      };
+      no_proxy = mkOption {
+        type = types.str;
+        default = "localhost,127.0.0.1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12";
+        description = "A list of domains for which the proxy must not be used";
+      };
+      nobrowser = mkOption {
+        type = types.bool;
+        default = true;
+        description = "If we should not auto-open a browser window on startup";
+      };
+      notifications_enabled = mkOption {
+        type = types.bool;
+        default = true;
+        description = "If we should send notifications to the desktop";
+      };
+      parallel_tasks = mkOption {
+        type = types.int;
+        default = 1;
+        description = "Number of parallel tasks to start during scan/generate";
+      };
+      preview_audio = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Include audio stream in previews";
+      };
+      preview_exclude_end = mkOption {
+        type = types.int;
+        default = 0;
+        description = "Duration of start of video to exclude when generating previews";
+      };
+      preview_exclude_start = mkOption {
+        type = types.int;
+        default = 0;
+        description = "Duration of end of video to exclude when generating previews";
+      };
+      preview_segment_duration = mkOption {
+        type = types.float;
+        default = 0.75;
+        description = "Preview segment duration, in seconds";
+      };
+      preview_segments = mkOption {
+        type = types.int;
+        default = 12;
+        description = "Number of segments in a preview file";
+      };
+      security_tripwire_accessed_from_public_internet = mkOption {
+        type = types.nullOr types.str;
+        default = "";
+        description = "Learn more at https://docs.stashapp.cc/networking/authentication-required-when-accessing-stash-from-the-internet/";
+      };
+      sequential_scanning = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Modifies behaviour of the scanning functionality to generate support files (previews/sprites/phash) at the same time as fingerprinting/screenshotting";
+      };
+      show_one_time_moved_notification = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Whether a small notification to inform the user that Stash will no longer show a terminal window, and instead will be available in the tray";
+      };
+      sound_on_preview = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Enable sound on mouseover previews";
+      };
+      theme_color = mkOption {
+        type = types.str;
+        default = "#202b33";
+        description = "Sets the `theme-color` property in the UI";
+      };
+      video_file_naming_algorithm = mkOption {
+        type = types.enum [
+          "OSHASH"
+          "MD5"
+        ];
+        default = "OSHASH";
+        description = "Hash algorithm to use for generated file naming";
+      };
+      write_image_thumbnails = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Write image thumbnails to disk when generating on the fly";
+      };
+    };
+  };
+
+  pluginType =
+    kind:
+    mkOption {
+      type = types.listOf types.package;
+      default = [ ];
+      description = ''
+        The ${kind} Stash should be started with.
+      '';
+      apply =
+        srcs:
+        optionalString (srcs != [ ]) (
+          pkgs.runCommand "stash-${kind}"
+            {
+              inherit srcs;
+              nativeBuildInputs = [ pkgs.yq-go ];
+              preferLocalBuild = true;
+            }
+            ''
+              find $srcs -mindepth 1 -name '*.yml' | while read plugin_file; do
+                grep -q "^#pkgignore" "$plugin_file" && continue
+
+                plugin_dir=$(dirname $plugin_file)
+                out_path=$out/$(basename $plugin_dir)
+                mkdir -p $out_path
+                ls $plugin_dir | xargs -I{} ln -sf "$plugin_dir/{}" $out_path
+
+                env \
+                  plugin_id=$(basename $plugin_file .yml) \
+                  plugin_name="$(yq '.name' $plugin_file)" \
+                  plugin_description="$(yq '.description' $plugin_file)" \
+                  plugin_version="$(yq '.version' $plugin_file)" \
+                  plugin_files="$(find -L $out_path -mindepth 1 -type f -printf "%P\n")" \
+                  yq -n '
+                    .id = strenv(plugin_id) |
+                    .name = strenv(plugin_name) |
+                    (
+                      strenv(plugin_description) as $desc |
+                      with(select($desc == "null"); .metadata = {}) |
+                      with(select($desc != "null"); .metadata.description = $desc)
+                    ) |
+                    (
+                      strenv(plugin_version) as $ver |
+                      with(select($ver == "null"); .version = "Unknown") |
+                      with(select($ver != "null"); .version = $ver)
+                    ) |
+                    .date = (now | format_datetime("2006-01-02 15:04:05")) |
+                    .files = (strenv(plugin_files) | split("\n"))
+                  ' > $out_path/manifest
+              done
+            ''
+        );
+    };
+in
+{
+  meta = {
+    buildDocsInSandbox = false;
+    maintainers = with lib.maintainers; [ DrakeTDL ];
+  };
+
+  options = {
+    services.stash = {
+      enable = mkEnableOption "stash";
+
+      package = mkPackageOption pkgs "stash" { };
+
+      user = mkOption {
+        type = types.str;
+        default = "stash";
+        description = "User under which Stash runs.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "stash";
+        description = "Group under which Stash runs.";
+      };
+
+      dataDir = mkOption {
+        type = types.path;
+        default = "/var/lib/stash";
+        description = "The directory where Stash stores its files.";
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Open ports in the firewall for the Stash web interface.";
+      };
+
+      username = mkOption {
+        type = types.nullOr types.nonEmptyStr;
+        default = null;
+        example = "admin";
+        description = ''
+          Username for login.
+
+          ::: {.warning}
+            This option takes precedence over {option}`services.stash.settings.username`
+          ::
+
+        '';
+      };
+
+      passwordFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/path/to/password/file";
+        description = ''
+          Path to file containing password for login.
+
+          ::: {.warning}
+            This option takes precedence over {option}`services.stash.settings.password`
+          ::
+
+        '';
+      };
+
+      jwtSecretKeyFile = mkOption {
+        type = types.path;
+        description = "Path to file containing a secret used to sign JWT tokens.";
+      };
+      sessionStoreKeyFile = mkOption {
+        type = types.path;
+        description = "Path to file containing a secret for session store.";
+      };
+
+      mutableSettings = mkOption {
+        description = ''
+          Whether the Stash config.yml is writeable by Stash.
+
+          If `false`, Any config changes done from within Stash UI will be temporary and reset to those defined in {option}`services.stash.settings` upon `Stash.service` restart.
+          If `true`, the {option}`services.stash.settings` will only be used to initialize the Stash configuration if it does not exist, and are subsequently ignored.
+        '';
+        type = types.bool;
+        default = true;
+      };
+      mutablePlugins = mkEnableOption "Whether plugins/themes can be installed, updated, uninstalled manually.";
+      mutableScrapers = mkEnableOption "Whether scrapers can be installed, updated, uninstalled manually.";
+      plugins = pluginType "plugins";
+      scrapers = pluginType "scrapers";
+
+      settings = mkOption {
+        type = settingsType;
+        description = "Stash configuration";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion =
+          !lib.xor (cfg.username != null || cfg.settings.username or null != null) (
+            cfg.passwordFile != null || cfg.settings.password or null != null
+          );
+        message = "You must set either both username and password, or neither.";
+      }
+    ];
+
+    services.stash.settings = {
+      username = mkIf (cfg.username != null) cfg.username;
+      plugins_path = mkIf (!cfg.mutablePlugins) cfg.plugins;
+      scrapers_path = mkIf (!cfg.mutableScrapers) cfg.scrapers;
+    };
+
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.settings.port ];
+
+    users.users.${cfg.user} = {
+      inherit (cfg) group;
+      isSystemUser = true;
+      home = cfg.dataDir;
+    };
+    users.groups.${cfg.group} = { };
+
+    systemd = {
+      tmpfiles.settings."10-stash-datadir".${cfg.dataDir}."d" = {
+        inherit (cfg) user group;
+        mode = "0755";
+      };
+      services.stash = {
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        path = with pkgs; [
+          ffmpeg-full
+          python3
+          ruby
+        ];
+        environment.STASH_CONFIG_FILE = "${cfg.dataDir}/config.yml";
+        serviceConfig = {
+          DynamicUser = false;
+          User = cfg.user;
+          Group = cfg.group;
+          Restart = "on-failure";
+          WorkingDirectory = cfg.dataDir;
+          StateDirectory = mkIf (cfg.dataDir == "/var/lib/stash") (baseNameOf cfg.dataDir);
+          ExecStartPre = pkgs.writers.writeBash "stash-setup.bash" (
+            ''
+              install -d ${cfg.settings.generated}
+              if [[ ! -z "${toString cfg.mutableSettings}" || ! -f ${cfg.dataDir}/config.yml ]]; then
+                env \
+                  password=$(< ${cfg.passwordFile}) \
+                  jwtSecretKeyFile=$(< ${cfg.jwtSecretKeyFile}) \
+                  sessionStoreKeyFile=$(< ${cfg.sessionStoreKeyFile}) \
+                  ${lib.getExe pkgs.yq-go} '
+                    .jwt_secret_key = strenv(jwtSecretKeyFile) |
+                    .session_store_key = strenv(sessionStoreKeyFile) |
+                    (
+                      strenv(password) as $password |
+                      with(select($password != ""); .password = $password)
+                    )
+                  ' ${settingsFile} > ${cfg.dataDir}/config.yml
+              fi
+            ''
+            + optionalString cfg.mutablePlugins ''
+              install -d ${cfg.settings.plugins_path}
+              ls ${cfg.plugins} | xargs -I{} ln -sf '${cfg.plugins}/{}' ${cfg.settings.plugins_path}
+            ''
+            + optionalString cfg.mutableScrapers ''
+              install -d ${cfg.settings.scrapers_path}
+              ls ${cfg.scrapers} | xargs -I{} ln -sf '${cfg.scrapers}/{}' ${cfg.settings.scrapers_path}
+            ''
+          );
+          ExecStart = getExe cfg.package;
+
+          ProtectHome = "tmpfs";
+          BindReadOnlyPaths = mkIf (cfg.settings != { }) (map (stash: "${stash.path}") cfg.settings.stash);
+
+          # hardening
+
+          DevicePolicy = "auto"; # needed for hardware acceleration
+          PrivateDevices = false; # needed for hardware acceleration
+          AmbientCapabilities = [ "" ];
+          CapabilityBoundingSet = [ "" ];
+          ProtectSystem = "full";
+          LockPersonality = true;
+          NoNewPrivileges = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProcSubset = "pid";
+          ProtectProc = "invisible";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_UNIX"
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          MemoryDenyWriteExecute = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "~@cpu-emulation"
+            "~@debug"
+            "~@mount"
+            "~@obsolete"
+            "~@privileged"
+          ];
+        };
+      };
+    };
+  };
+}
@@ -982,6 +982,7 @@ in {
  stalwart-mail = handleTest ./stalwart-mail.nix {};
  stargazer = runTest ./web-servers/stargazer.nix;
  starship = handleTest ./starship.nix {};
+  stash = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./stash.nix {};
  static-web-server = handleTest ./web-servers/static-web-server.nix {};
  step-ca = handleTestOn ["x86_64-linux"] ./step-ca.nix {};
  stratis = handleTest ./stratis {};
@@ -10,11 +10,9 @@ import ./make-test-python.nix (
      install -D -t $out key.pem cert.pem
    '';

-    # Git repositories paths in Gitolite.
-    # Here only their baseNameOf is used for configuring public-inbox inboxes.
    gitRepositories = [
-      "user/repo1"
-      "user/repo2"
+      "repo1"
+      "repo2"
    ];
  in
  {
@@ -81,7 +79,7 @@ import ./make-test-python.nix (
          };
          inboxes =
            lib.recursiveUpdate
-              (lib.genAttrs (map baseNameOf gitRepositories) (repo: {
+              (lib.genAttrs gitRepositories (repo: {
                address = [
                  # Routed to the "public-inbox:" transport in services.postfix.transport
                  "${repo}@${domain}"
@@ -106,7 +104,7 @@ import ./make-test-python.nix (
          settings.coderepo = lib.listToAttrs (
            map (
              repositoryName:
-              lib.nameValuePair (baseNameOf repositoryName) {
+              lib.nameValuePair repositoryName {
                dir = "/var/lib/public-inbox/repositories/${repositoryName}.git";
                cgitUrl = "https://git.${domain}/${repositoryName}.git";
              }
@@ -183,6 +181,12 @@ import ./make-test-python.nix (
    testScript = ''
      start_all()

+      # The threshold and/or hardening may have to be changed with new features/checks
+      with subtest("systemd hardening thresholds"):
+        print(machine.succeed("systemd-analyze security public-inbox-httpd.service --threshold=5 --no-pager"))
+        print(machine.succeed("systemd-analyze security public-inbox-imapd.service --threshold=5 --no-pager"))
+        print(machine.succeed("systemd-analyze security public-inbox-nntpd.service --threshold=4 --no-pager"))
+
      machine.wait_for_unit("multi-user.target")
      machine.wait_for_unit("public-inbox-init.service")

@@ -0,0 +1,80 @@
+import ./make-test-python.nix (
+  let
+    host = "127.0.0.1";
+    port = 1234;
+    dataDir = "/stash";
+  in
+  { pkgs, ... }:
+  {
+    name = "stash";
+    meta.maintainers = pkgs.stash.meta.maintainers;
+
+    nodes.machine = {
+      services.stash = {
+        inherit dataDir;
+        enable = true;
+
+        username = "test";
+        passwordFile = pkgs.writeText "stash-password" "MyPassword";
+
+        jwtSecretKeyFile = pkgs.writeText "jwt_secret_key" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+        sessionStoreKeyFile = pkgs.writeText "session_store_key" "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
+
+        plugins =
+          let
+            src = pkgs.fetchFromGitHub {
+              owner = "stashapp";
+              repo = "CommunityScripts";
+              rev = "9b6fac4934c2fac2ef0859ea68ebee5111fc5be5";
+              hash = "sha256-PO3J15vaA7SD4r/LyHlXjnpaeYAN9Q++O94bIWdz7OA=";
+            };
+          in
+          [
+            (pkgs.runCommand "stashNotes" { inherit src; } ''
+              mkdir -p $out/plugins
+              cp -r $src/plugins/stashNotes $out/plugins/stashNotes
+            '')
+            (pkgs.runCommand "Theme-Plex" { inherit src; } ''
+              mkdir -p $out/plugins
+              cp -r $src/themes/Theme-Plex $out/plugins/Theme-Plex
+            '')
+          ];
+
+        mutableScrapers = true;
+        scrapers =
+          let
+            src = pkgs.fetchFromGitHub {
+              owner = "stashapp";
+              repo = "CommunityScrapers";
+              rev = "2ece82d17ddb0952c16842b0775274bcda598d81";
+              hash = "sha256-AEmnvM8Nikhue9LNF9dkbleYgabCvjKHtzFpMse4otM=";
+            };
+          in
+          [
+            (pkgs.runCommand "FTV" { inherit src; } ''
+              mkdir -p $out/scrapers/FTV
+              cp -r $src/scrapers/FTV.yml $out/scrapers/FTV
+            '')
+          ];
+
+        settings = {
+          inherit host port;
+
+          stash = [ { path = "/srv"; } ];
+        };
+      };
+    };
+
+    testScript = ''
+      machine.wait_for_unit("stash.service")
+      machine.wait_for_open_port(${toString port}, "${host}")
+      machine.succeed("curl --fail http://${host}:${toString port}/")
+
+      with subtest("Test plugins/scrapers"):
+        with subtest("mutable plugins directory should not exist"):
+          machine.fail("test -d ${dataDir}/plugins")
+        with subtest("mutable scrapers directory should exist and scraper FTV should be linked"):
+          machine.succeed("test -L ${dataDir}/scrapers/FTV")
+    '';
+  }
+)
@@ -21,7 +21,7 @@

 stdenv.mkDerivation rec {
  pname = "f3d";
-  version = "2.5.1";
+  version = "3.0.0";

  outputs = [ "out" ] ++ lib.optionals withManual [ "man" ];

@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
    owner = "f3d-app";
    repo = "f3d";
    tag = "v${version}";
-    hash = "sha256-S3eigdW6rkDRSm4uCCTFHx5fhJGNVWpAAAKboougr08=";
+    hash = "sha256-mnDmo5qzdnElhvZwBmHL3xC2o8iLuvYyfZXHoaAUG08=";
  };

  nativeBuildInputs = [
@@ -24,9 +24,6 @@
  rustPlatform,
  rustc,
  srcs,
-
-  # provided as callPackage input to enable easier overrides through overlays
-  cargoSha256 ? "sha256-PSrTo7nGgH0KxA82RlBEwtOu80WMCBeaCxHj3n7SgEE=",
 }:

 mkDerivation rec {
@@ -40,11 +37,11 @@ mkDerivation rec {
    })
  ];

-  cargoDeps = rustPlatform.fetchCargoTarball {
+  cargoDeps = rustPlatform.fetchCargoVendor {
    # include version in the name so we invalidate the FOD
    name = "${pname}-${srcs.angelfish.version}";
    inherit (srcs.angelfish) src;
-    sha256 = cargoSha256;
+    hash = "sha256-M3CtP7eWqOxMvnak6K3QvB/diu4jAfMmlsa6ySFIHCU=";
  };

  nativeBuildInputs = [
@@ -9,6 +9,8 @@
  libGLU,
  libSM,

+  libXcomposite,
+  libXi,
  libXrender,
  libX11,

@@ -38,11 +40,11 @@ let
 in
 mkDerivation rec {
  pname = "googleearth-pro";
-  version = "7.3.6.9796";
+  version = "7.3.6.10201";

  src = fetchurl {
    url = "https://dl.google.com/linux/earth/deb/pool/main/g/google-earth-pro-stable/google-earth-pro-stable_${version}-r0_${arch}.deb";
-    sha256 = "sha256-Wv2jPGN7LC5T32WdX3W1BfGYrcXTNWTI1Wv+PmD0gNM=";
+    sha256 = "sha256-LqkXOSfE52+7x+Y0DBjYzvVKO0meytLNHuS/ia88FbI=";
  };

  nativeBuildInputs = [
@@ -63,6 +65,8 @@ mkDerivation rec {
    libGLU
    libSM
    libX11
+    libXcomposite
+    libXi
    libXrender
    libproxy
    libxcb
@@ -24,7 +24,7 @@ let
  vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
  pname = "vivaldi";
-  version = "7.0.3495.29";
+  version = "7.1.3570.39";

  suffix = {
    aarch64-linux = "arm64";
@@ -34,8 +34,8 @@ in stdenv.mkDerivation rec {
  src = fetchurl {
    url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
    hash = {
-      aarch64-linux = "sha256-GdywFoaxx2VSpOJ0FJIhFcIRDJEhozCWvYvdatmEi5o=";
-      x86_64-linux = "sha256-PNSGx2oCIbB3vaNFS+7coM9Xw+2qDELJBXX8zA1UC3Q=";
+      aarch64-linux = "sha256-rhIz+vX/W39sN/j37nhaq+iEbIc/rfgMprqmX+DM2D8=";
+      x86_64-linux = "sha256-d6NQRueNE9P2/IOLwBIm4evrqO0D+RNKUUC156PEgcc=";
    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };

@@ -354,11 +354,11 @@
    "vendorHash": "sha256-quoFrJbB1vjz+MdV+jnr7FPACHuUe5Gx9POLubD2IaM="
  },
  "digitalocean": {
-    "hash": "sha256-mPNc65zah7HO3Knd44qxbwGgPp4LyxG76abBOV/1D3I=",
+    "hash": "sha256-JRBur7pH1niPZLN+5do6GiuoiSP18QsDZqWjlc9riek=",
    "homepage": "https://registry.terraform.io/providers/digitalocean/digitalocean",
    "owner": "digitalocean",
    "repo": "terraform-provider-digitalocean",
-    "rev": "v2.46.1",
+    "rev": "v2.47.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -6,6 +6,9 @@
  protonvpn-nm-lib,
  pythondialog,
  dialog,
+  wrapGAppsNoGuiHook,
+  gobject-introspection,
+  glib,
 }:

 buildPythonApplication rec {
@@ -22,12 +25,27 @@ buildPythonApplication rec {
    sha256 = "sha256-KhfogC23i7THe6YZJ6Sy1+q83vZupHsS69NurHCeo8I=";
  };

+  nativeBuildInputs = [
+    wrapGAppsNoGuiHook
+    gobject-introspection
+  ];
+
+  buildInputs = [
+    glib
+  ];
+
  propagatedBuildInputs = [
    protonvpn-nm-lib
    pythondialog
    dialog
  ];

+  dontWrapGApps = true;
+
+  makeWrapperArgs = [
+    "\${gappsWrapperArgs[@]}"
+  ];
+
  # Project has a dummy test
  doCheck = false;

@@ -31,11 +31,11 @@

 mkDerivation rec {
  pname = "skrooge";
-  version = "2.33.0";
+  version = "25.1.0";

  src = fetchurl {
    url = "mirror://kde/stable/skrooge/skrooge-${version}.tar.xz";
-    hash = "sha256-9K4/r3I9VNdUKHi4FCo0SxR+QzewvEKGOQevRM/r9GU=";
+    hash = "sha256-t8A9egotR2XoMBo5uoH2RBPEo3H6nPSJS5Oi4MkSVww=";
  };

  nativeBuildInputs = [
@@ -60,6 +60,7 @@ let
   "8.19.2".sha256   = "sha256-q+i07JsMZp83Gqav6v1jxsgPLN7sPvp5/oszVnavmz0=";
   "8.20.0".sha256   = "sha256-WFpZlA6CzFVAruPhWcHQI7VOBVhrGLdFzWrHW0DTSl0=";
   "8.20.1".sha256   = "sha256-nRaLODPG4E3gUDzGrCK40vhl4+VhPyd+/fXFK/HC3Ig=";
+   "9.0+rc1".sha256  = "sha256-TLq925HFdizxyHjKRMeHBH9rLRpLNUiVIfA1JSMgYXA=";
  };
  releaseRev = v: "V${v}";
  fetched = import ../../../../build-support/coq/meta-fetch/default.nix
@@ -1,104 +1,147 @@
-{ lib, stdenv, fetchFromGitHub, python3Packages, libunistring
-, harfbuzz, fontconfig, pkg-config, ncurses, imagemagick
-, libstartup_notification, libGL, libX11, libXrandr, libXinerama, libXcursor
-, libxkbcommon, libXi, libXext, wayland-protocols, wayland, xxHash
-, nerd-fonts
-, lcms2
-, librsync
-, openssl
-, installShellFiles
-, dbus
-, sudo
-, Libsystem
-, Cocoa
-, Kernel
-, UniformTypeIdentifiers
-, UserNotifications
-, libcanberra
-, libicns
-, wayland-scanner
-, libpng
-, python3
-, zlib
-, simde
-, bashInteractive
-, zsh
-, fish
-, nixosTests
-, go_1_23
-, buildGo123Module
-, nix-update-script
-, makeBinaryWrapper
-, autoSignDarwinBinariesHook
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  python3Packages,
+  libunistring,
+  harfbuzz,
+  fontconfig,
+  pkg-config,
+  ncurses,
+  imagemagick,
+  libstartup_notification,
+  libGL,
+  libX11,
+  libXrandr,
+  libXinerama,
+  libXcursor,
+  libxkbcommon,
+  libXi,
+  libXext,
+  wayland-protocols,
+  wayland,
+  xxHash,
+  nerd-fonts,
+  lcms2,
+  librsync,
+  openssl,
+  installShellFiles,
+  dbus,
+  sudo,
+  Libsystem,
+  Cocoa,
+  Kernel,
+  UniformTypeIdentifiers,
+  UserNotifications,
+  libcanberra,
+  libicns,
+  wayland-scanner,
+  libpng,
+  python3,
+  zlib,
+  simde,
+  bashInteractive,
+  zsh,
+  fish,
+  nixosTests,
+  go_1_23,
+  buildGo123Module,
+  nix-update-script,
+  makeBinaryWrapper,
+  autoSignDarwinBinariesHook,
 }:

 with python3Packages;
 buildPythonApplication rec {
  pname = "kitty";
-  version = "0.38.1";
+  version = "0.39.0";
  format = "other";

  src = fetchFromGitHub {
    owner = "kovidgoyal";
    repo = "kitty";
    tag = "v${version}";
-    hash = "sha256-0M4Bvhh3j9vPedE/d+8zaiZdET4mXcrSNUgLllhaPJw=";
+    hash = "sha256-4JlsIwQzCxs1i8Pvsj9KcJZpXbVkSzWtW7klatA0FOM";
  };

-  goModules = (buildGo123Module {
-    pname = "kitty-go-modules";
-    inherit src version;
-    vendorHash = "sha256-K12P81jE7oOU7qX2yQ+VtVHX/igKG0nPMSBkZ7wsR0o=";
-  }).goModules;
+  goModules =
+    (buildGo123Module {
+      pname = "kitty-go-modules";
+      inherit src version;
+      vendorHash = "sha256-Yahn+nlarPy4Yf1QmDminnHDqbe0+iJ6IsUKF0tioK4=";
+    }).goModules;

-  buildInputs = [
-    harfbuzz
-    ncurses
-    simde
-    lcms2
-    librsync
-    matplotlib
-    openssl.dev
-    xxHash
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    Cocoa
-    Kernel
-    UniformTypeIdentifiers
-    UserNotifications
-    libpng
-    python3
-    zlib
-  ] ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-    Libsystem
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    fontconfig libunistring libcanberra libX11
-    libXrandr libXinerama libXcursor libxkbcommon libXi libXext
-    wayland-protocols wayland dbus libGL
-  ];
+  buildInputs =
+    [
+      harfbuzz
+      ncurses
+      simde
+      lcms2
+      librsync
+      matplotlib
+      openssl.dev
+      xxHash
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      Cocoa
+      Kernel
+      UniformTypeIdentifiers
+      UserNotifications
+      libpng
+      python3
+      zlib
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
+      Libsystem
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      fontconfig
+      libunistring
+      libcanberra
+      libX11
+      libXrandr
+      libXinerama
+      libXcursor
+      libxkbcommon
+      libXi
+      libXext
+      wayland-protocols
+      wayland
+      dbus
+      libGL
+    ];

-  nativeBuildInputs = [
-    installShellFiles
-    ncurses
-    pkg-config
-    sphinx
-    furo
-    sphinx-copybutton
-    sphinxext-opengraph
-    sphinx-inline-tabs
-    go_1_23
-    fontconfig
-    makeBinaryWrapper
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    imagemagick
-    libicns  # For the png2icns tool.
-    autoSignDarwinBinariesHook
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    wayland-scanner
-  ];
+  nativeBuildInputs =
+    [
+      installShellFiles
+      ncurses
+      pkg-config
+      sphinx
+      furo
+      sphinx-copybutton
+      sphinxext-opengraph
+      sphinx-inline-tabs
+      go_1_23
+      fontconfig
+      makeBinaryWrapper
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      imagemagick
+      libicns # For the png2icns tool.
+      autoSignDarwinBinariesHook
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      wayland-scanner
+    ];

  depsBuildBuild = [ pkg-config ];

-  outputs = [ "out" "terminfo" "shell_integration" "kitten" ];
+  outputs = [
+    "out"
+    "terminfo"
+    "shell_integration"
+    "kitten"
+  ];

  patches = [
    # Gets `test_ssh_env_vars` to pass when `bzip2` is in the output of `env`.
@@ -130,49 +173,58 @@ buildPythonApplication rec {
    cp -r --reflink=auto $goModules vendor
  '';

-  buildPhase = let
-    commonOptions = ''
-      --update-check-interval=0 \
-      --shell-integration=enabled\ no-rc
+  buildPhase =
+    let
+      commonOptions = ''
+        --update-check-interval=0 \
+        --shell-integration=enabled\ no-rc
+      '';
+      darwinOptions = ''
+        --disable-link-time-optimization \
+        ${commonOptions}
+      '';
+    in
+    ''
+      runHook preBuild
+
+      # Add the font by hand because fontconfig does not finds it in darwin
+      mkdir ./fonts/
+      cp "${nerd-fonts.symbols-only}/share/fonts/truetype/NerdFonts/Symbols/SymbolsNerdFontMono-Regular.ttf" ./fonts/
+
+      ${
+        if stdenv.hostPlatform.isDarwin then
+          ''
+            ${python.pythonOnBuildForHost.interpreter} setup.py build ${darwinOptions}
+            make docs
+            ${python.pythonOnBuildForHost.interpreter} setup.py kitty.app ${darwinOptions}
+          ''
+        else
+          ''
+            ${python.pythonOnBuildForHost.interpreter} setup.py linux-package \
+            --egl-library='${lib.getLib libGL}/lib/libEGL.so.1' \
+            --startup-notification-library='${libstartup_notification}/lib/libstartup-notification-1.so' \
+            --canberra-library='${libcanberra}/lib/libcanberra.so' \
+            --fontconfig-library='${fontconfig.lib}/lib/libfontconfig.so' \
+            ${commonOptions}
+            ${python.pythonOnBuildForHost.interpreter} setup.py build-launcher
+          ''
+      }
+      runHook postBuild
    '';
-    darwinOptions = ''
-      --disable-link-time-optimization \
-      ${commonOptions}
-    '';
-  in ''
-    runHook preBuild

-    # Add the font by hand because fontconfig does not finds it in darwin
-    mkdir ./fonts/
-    cp "${nerd-fonts.symbols-only}/share/fonts/truetype/NerdFonts/Symbols/SymbolsNerdFontMono-Regular.ttf" ./fonts/
+  nativeCheckInputs =
+    [
+      pillow

-    ${if stdenv.hostPlatform.isDarwin then ''
-      ${python.pythonOnBuildForHost.interpreter} setup.py build ${darwinOptions}
-      make docs
-      ${python.pythonOnBuildForHost.interpreter} setup.py kitty.app ${darwinOptions}
-    '' else ''
-      ${python.pythonOnBuildForHost.interpreter} setup.py linux-package \
-      --egl-library='${lib.getLib libGL}/lib/libEGL.so.1' \
-      --startup-notification-library='${libstartup_notification}/lib/libstartup-notification-1.so' \
-      --canberra-library='${libcanberra}/lib/libcanberra.so' \
-      --fontconfig-library='${fontconfig.lib}/lib/libfontconfig.so' \
-      ${commonOptions}
-      ${python.pythonOnBuildForHost.interpreter} setup.py build-launcher
-    ''}
-    runHook postBuild
-  '';
-
-  nativeCheckInputs = [
-    pillow
-
-    # Shells needed for shell integration tests
-    bashInteractive
-    zsh
-    fish
-  ] ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
-    # integration tests need sudo
-    sudo
-  ];
+      # Shells needed for shell integration tests
+      bashInteractive
+      zsh
+      fish
+    ]
+    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+      # integration tests need sudo
+      sudo
+    ];

  # skip failing tests due to darwin sandbox
  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
@@ -186,49 +238,61 @@ buildPythonApplication rec {
  '';

  checkPhase = ''
-      runHook preCheck
+    runHook preCheck

-      # Fontconfig error: Cannot load default config file: No such file: (null)
-      export FONTCONFIG_FILE=${fontconfig.out}/etc/fonts/fonts.conf
+    # Fontconfig error: Cannot load default config file: No such file: (null)
+    export FONTCONFIG_FILE=${fontconfig.out}/etc/fonts/fonts.conf

-      # Required for `test_ssh_shell_integration` to pass.
-      export TERM=kitty
+    # Required for `test_ssh_shell_integration` to pass.
+    export TERM=kitty

-      make test
-      runHook postCheck
-    '';
+    make test
+    runHook postCheck
+  '';

  installPhase = ''
    runHook preInstall
    mkdir -p "$out"
    mkdir -p "$kitten/bin"
-    ${if stdenv.hostPlatform.isDarwin then ''
-    mkdir "$out/bin"
-    ln -s ../Applications/kitty.app/Contents/MacOS/kitty "$out/bin/kitty"
-    ln -s ../Applications/kitty.app/Contents/MacOS/kitten "$out/bin/kitten"
-    cp ./kitty.app/Contents/MacOS/kitten "$kitten/bin/kitten"
-    mkdir "$out/Applications"
-    cp -r kitty.app "$out/Applications/kitty.app"
+    ${
+      if stdenv.hostPlatform.isDarwin then
+        ''
+          mkdir "$out/bin"
+          ln -s ../Applications/kitty.app/Contents/MacOS/kitty "$out/bin/kitty"
+          ln -s ../Applications/kitty.app/Contents/MacOS/kitten "$out/bin/kitten"
+          cp ./kitty.app/Contents/MacOS/kitten "$kitten/bin/kitten"
+          mkdir "$out/Applications"
+          cp -r kitty.app "$out/Applications/kitty.app"

-    installManPage 'docs/_build/man/kitty.1'
-    '' else ''
-    cp -r linux-package/{bin,share,lib} "$out"
-    cp linux-package/bin/kitten "$kitten/bin/kitten"
-    ''}
+          installManPage 'docs/_build/man/kitty.1'
+        ''
+      else
+        ''
+          cp -r linux-package/{bin,share,lib} "$out"
+          cp linux-package/bin/kitten "$kitten/bin/kitten"
+        ''
+    }

    # dereference the `kitty` symlink to make sure the actual executable
    # is wrapped on macOS as well (and not just the symlink)
-    wrapProgram $(realpath "$out/bin/kitty") --prefix PATH : "$out/bin:${lib.makeBinPath [ imagemagick ncurses.dev ]}"
+    wrapProgram $(realpath "$out/bin/kitty") --prefix PATH : "$out/bin:${
+      lib.makeBinPath [
+        imagemagick
+        ncurses.dev
+      ]
+    }"

    installShellCompletion --cmd kitty \
      --bash <("$out/bin/kitty" +complete setup bash) \
      --fish <("$out/bin/kitty" +complete setup fish2) \
      --zsh  <("$out/bin/kitty" +complete setup zsh)

-    terminfo_src=${if stdenv.hostPlatform.isDarwin then
-      ''"$out/Applications/kitty.app/Contents/Resources/terminfo"''
+    terminfo_src=${
+      if stdenv.hostPlatform.isDarwin then
+        ''"$out/Applications/kitty.app/Contents/Resources/terminfo"''
      else
-      "$out/share/terminfo"}
+        "$out/share/terminfo"
+    }

    mkdir -p $terminfo/share
    mv "$terminfo_src" $terminfo/share/terminfo
@@ -245,12 +309,12 @@ buildPythonApplication rec {
    tests = lib.optionalAttrs stdenv.hostPlatform.isLinux {
      default = nixosTests.terminal-emulators.kitty;
    };
-    updateScript = nix-update-script {};
+    updateScript = nix-update-script { };
  };

  meta = with lib; {
    homepage = "https://github.com/kovidgoyal/kitty";
-    description = "Modern, hackable, featureful, OpenGL based terminal emulator";
+    description = "The fast, feature-rich, GPU based terminal emulator";
    license = licenses.gpl3Only;
    changelog = [
      "https://sw.kovidgoyal.net/kitty/changelog/"
@@ -258,6 +322,11 @@ buildPythonApplication rec {
    ];
    platforms = platforms.darwin ++ platforms.linux;
    mainProgram = "kitty";
-    maintainers = with maintainers; [ tex rvolosatovs Luflosi kashw2 ];
+    maintainers = with maintainers; [
+      tex
+      rvolosatovs
+      Luflosi
+      kashw2
+    ];
  };
 }
@@ -16,20 +16,20 @@ let
  bento4 = fetchFromGitHub {
    owner = "xbmc";
    repo = "Bento4";
-    rev = "1.6.0-641-${rel}";
-    sha256 = "sha256-vsFMDzH8JJecYw0qWKGCxnd/m5wn62mCKE2g2HwQhwI=";
+    tag = "1.6.0-641-3-${rel}";
+    hash = "sha256-ycWQvXgr1DQ3Wng73S8i6y6XmcUD/iN8OKfO1czgsnY=";
  };
 in
 buildKodiBinaryAddon rec {
  pname = "inputstream-adaptive";
  namespace = "inputstream.adaptive";
-  version = "21.4.6";
+  version = "21.5.9";

  src = fetchFromGitHub {
    owner = "xbmc";
    repo = "inputstream.adaptive";
-    rev = "${version}-${rel}";
-    sha256 = "sha256-ub4ep89datfr8aZLZAfoz7zhOizGFpzgp2PVON6Ptj8=";
+    tag = "${version}-${rel}";
+    hash = "sha256-OArvp/MgJGsRs3Z59JfgOkfwyhQ3ArC1yf37z7Y7khg=";
  };

  extraCMakeFlags = [
@@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "abracadabra";
-  version = "2.9.1";
+  version = "2.9.2";

  src = fetchFromGitHub {
    owner = "KejPi";
    repo = "AbracaDABra";
    rev = "v${version}";
-    hash = "sha256-T2l5wjE62xBb55IzKzInf/K4VPOuZ68vp5VxS0vIn+I=";
+    hash = "sha256-3sjN62SWl5Xpb2cP108IFqCuJAo8JLOCLxJENCrq8wI=";
  };

  nativeBuildInputs = [
@@ -6,12 +6,12 @@
 }:
 let
  pname = "bazecor";
-  version = "1.6.1";
+  version = "1.6.2";
  src = appimageTools.extract {
    inherit pname version;
    src = fetchurl {
      url = "https://github.com/Dygmalab/Bazecor/releases/download/v${version}/Bazecor-${version}-x64.AppImage";
-      hash = "sha256-Qf9FqHgTSCD2rYp8PC/gYHyiYcfFTJJmG4oRK/bch8Y=";
+      hash = "sha256-FfowCbnhGI0sglFvxf7ActUJC9Lsj97Ui08nObBnjoE=";
    };

    # Workaround for https://github.com/Dygmalab/Bazecor/issues/370
@@ -11,14 +11,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-public-api";
-  version = "0.42.0";
+  version = "0.43.0";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-vQhKvL9vRUq7WqtJ25v12DuCzO90bgXLmwu2Mm1jbig=";
+    hash = "sha256-oAtAfoWJ4YZ9YcU7DQtj6QqF1DSEMOUjauQxqo1a6GA=";
  };

-  cargoHash = "sha256-Gm72Hr+bVmNwdFAIsAatTcF9Il6JG2i6dQPu1ZQy46o=";
+  cargoHash = "sha256-+mrPrYk/qj4UtbUgFIFS0XUp25uLs8fNhvSzx1nu1ng=";

  nativeBuildInputs = [ pkg-config ];

@@ -16,13 +16,13 @@

 stdenv.mkDerivation {
  pname = "chawan";
-  version = "0-unstable-2024-12-27";
+  version = "0-unstable-2025-01-06";

  src = fetchFromSourcehut {
    owner = "~bptato";
    repo = "chawan";
-    rev = "93033c2c382aaff01b1aba6f5db7652c35708bf3";
-    hash = "sha256-MEOIu1CI/VTvd2cixa57Tv1xtBMXiMdD37ZYjAlg5S4=";
+    rev = "30a933adb2bade2ceee08a9b36371cecf554d648";
+    hash = "sha256-EepSEN66GTdWfCSiR/p69pN5bvTEiUFOMErCxedrq+g=";
    fetchSubmodules = true;
  };

@@ -11,14 +11,14 @@

 python3Packages.buildPythonApplication {
  pname = "chirp";
-  version = "0.4.0-unstable-2025-01-12";
+  version = "0.4.0-unstable-2025-01-22";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "kk7ds";
    repo = "chirp";
-    rev = "fc94f14823f3257961c4d0e144083fe6f397ad55";
-    hash = "sha256-J1Hhz6M1VhfIttz9lJnPNQsOJbzKBrb6Yz154oh3moo=";
+    rev = "470a8a0a5c5a878a72233339998f2e527dd32ff2";
+    hash = "sha256-H5N4YahSoMeKC+j6D6xj0MrZFUqcupvuqnahKhrq+sU=";
  };

  nativeBuildInputs = [
@@ -6,16 +6,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "clog-cli";
-  version = "0.9.3";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "clog-tool";
    repo = "clog-cli";
-    rev = "v${version}";
-    sha256 = "1wxglc4n1dar5qphhj5pab7ps34cjr7jy611fwn72lz0f6c7jp3z";
+    # Tag seems to be missing:
+    # https://github.com/clog-tool/clog-cli/issues/128
+    rev = "7066cba2bcbaea0f62ea22c320d48dac20f36a38";
+    sha256 = "sha256-d1csT7iHf48kLkn6/cGhoIoEN/kiYc6vlUwHDNmbnMI=";
  };

-  cargoHash = "sha256-yjBgccrkG2D8ZW3Uju4XUhz9Kar50jkJZ75MWhn9j3U=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-b8/n3y6fTqP5+rZySEDEb8Z5DPHQ2jUasp5SvaJJlGo=";

  meta = {
    description = "Generate changelogs from local git metadata";
@@ -24,7 +27,5 @@ rustPlatform.buildRustPackage rec {
    platforms = lib.platforms.unix;
    maintainers = [ lib.maintainers.nthorne ];
    mainProgram = "clog";
-    # error: could not compile `rustc-serialize`
-    broken = true; # Added 2024-03-16
  };
 }
@@ -17,7 +17,8 @@ rustPlatform.buildRustPackage rec {
    hash = "sha256-Nqf0NNjE3gu+75tjMKAY3Wn75PiPwpnXgXtzdhqx7u8=";
  };

-  cargoHash = "sha256-OLA9n7MBN5Fz3D3MJLb6PoEksO5Da2mp5h8pti2/lpA=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-ssyx72o/eTcFClLyl4QJ71okqKU2k6SZVH0eGEFzIjs=";

  cargoBuildFlags = [ "--package=clorinde" ];

@@ -1,5 +1,5 @@
 {
-  stdenv,
+  gcc13Stdenv,
  lib,
  fetchzip,
  autoconf,
@@ -21,6 +21,7 @@
 */

 let
+  stdenv = gcc13Stdenv;
  arch =
    if stdenv.hostPlatform.system == "x86_64-linux" then
      "64"
@@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "codespell";
-  version = "2.3.0";
+  version = "2.4.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "codespell-project";
    repo = "codespell";
-    rev = "v${version}";
-    sha256 = "sha256-X3Pueu0E7Q57sbKSXqCZki4/PUb1WyWk/Zmj+lhVTM8=";
+    tag = "v${version}";
+    sha256 = "sha256-TZH3+ZzsThh0GDtiSU1ZEStmCHmEuNDrk/Vyc8E2ESI=";
  };

  nativeBuildInputs = with python3.pkgs; [
@@ -1,25 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchCrate,
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "dwfv";
-  version = "0.4.1";
-
-  src = fetchCrate {
-    inherit version pname;
-    hash = "sha256-JzOD0QQfDfIkJQATxGpyJBrFg5l6lkkAXY2qv9bir3c=";
-  };
-
-  cargoHash = "sha256-nmnpHz9sCRlxOngcSrW+oktYIKM/A295/a03fUf3ofw=";
-
-  meta = with lib; {
-    description = "Simple digital waveform viewer with vi-like key bindings";
-    mainProgram = "dwfv";
-    homepage = "https://github.com/psurply/dwfv";
-    license = licenses.mit;
-    maintainers = with maintainers; [ newam ];
-  };
-}
@@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "eigenmath";
-  version = "337-unstable-2024-12-20";
+  version = "337-unstable-2025-01-25";

  src = fetchFromGitHub {
    owner = "georgeweigt";
    repo = pname;
-    rev = "571412786696680e1e04909e90e77d9d39b10b2a";
-    hash = "sha256-7/5UsU5TSW++MROWuUTsAptkv7gcqhvcqaRHYzXswB8=";
+    rev = "ae71bdf698283760ad3ac74ce57158f25c8d9198";
+    hash = "sha256-vmbujai7xW4U6fmsp4Gv63Tl3AcxOUsUA2rPTfFL3ZQ=";
  };

  checkPhase =
@@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "fastd";
-  version = "22";
+  version = "23";

  src = fetchFromGitHub {
-    owner = "Neoraider";
+    owner = "neocturne";
    repo = "fastd";
    rev = "v${version}";
-    sha256 = "0qni32j7d3za9f87m68wq8zgalvfxdrx1zxi6l4x7vvmpcw5nhpq";
+    sha256 = "sha256-Sz6VEjKziL/w2a4VWFfMPDYvm7UZh5A/NmzP10rJ2r8=";
  };

  nativeBuildInputs = [
@@ -59,7 +59,10 @@ stdenv.mkDerivation rec {
      bsd3
    ];
    platforms = platforms.linux;
-    maintainers = with maintainers; [ fpletz ];
+    maintainers = with maintainers; [
+      fpletz
+      herbetom
+    ];
    mainProgram = "fastd";
  };
 }
@@ -45,13 +45,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "fastfetch";
-  version = "2.34.1";
+  version = "2.35.0";

  src = fetchFromGitHub {
    owner = "fastfetch-cli";
    repo = "fastfetch";
    tag = finalAttrs.version;
-    hash = "sha256-kCSRS2GD58HS9Qdrv7ju8b7IGznBsP1IIAvvzkWPaLk=";
+    hash = "sha256-ChuK5DHRj1qJIjRo3oB5gdCxox2mDffCVM0wRGc5t1o=";
  };

  outputs = [
@@ -8,20 +8,20 @@

 buildNpmPackage rec {
  pname = "flood";
-  version = "4.8.5";
+  version = "4.9.0";

  src = fetchFromGitHub {
    owner = "jesec";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-lm+vPo7V99OSUAVEvdiTNMlD/+iHGPIyPLc1WzO1aTU=";
+    hash = "sha256-R8OWr9jsD6KZ3P827plCTSLcVrrFEdutmlZNwqXJNfU=";
  };

  npmConfigHook = pnpm_9.configHook;
  npmDeps = pnpmDeps;
  pnpmDeps = pnpm_9.fetchDeps {
    inherit pname version src;
-    hash = "sha256-NuU9O3bEboxmuEuk1WSUeZRNgVK5cwFiUAN3+7vACGw=";
+    hash = "sha256-6YW2m7siLzHiAFEpidQS5okhjsY9qNm+Ro8mHex1/No=";
  };

  passthru = {
@@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "flyctl";
-  version = "0.3.61";
+  version = "0.3.68";

  src = fetchFromGitHub {
    owner = "superfly";
    repo = "flyctl";
    rev = "v${version}";
-    hash = "sha256-YGUjEK8Yvb1S879MNQ/gJYNG4DjFMTL2VHE/m5KLoE0=";
+    hash = "sha256-6/84MC7wmMCfCtuV0HJ/zMG96RO55LQxudejI5exVAM=";
  };

-  vendorHash = "sha256-SqG5JJ2l71+fQirsg51hjr5sFHQzzH3U+acJMaN5W0c=";
+  vendorHash = "sha256-aKDziIx0xyWOczc9G0YQ7mdWdc5cWHjpjTDyJMsFriM=";

  subPackages = [ "." ];

@@ -6,6 +6,7 @@
  recode,
  perl,
  rinutils,
+  fortune,
  withOffensive ? false,
 }:

@@ -20,11 +21,16 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-Hzh4dyVOleq2H5NyV7QmCfKbmU7wVxUxZVu/w6KsdKw=";
  };

-  nativeBuildInputs = [
-    cmake
-    perl
-    rinutils
-  ];
+  nativeBuildInputs =
+    [
+      cmake
+      perl
+      rinutils
+    ]
+    ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+      # "strfile" must be in PATH for cross-compiling builds.
+      fortune
+    ];

  buildInputs = [ recode ];

@@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "gh-markdown-preview";
-  version = "1.9.0";
+  version = "1.10.0";

  src = fetchFromGitHub {
    owner = "yusukebe";
    repo = "gh-markdown-preview";
    rev = "v${version}";
-    hash = "sha256-qvR23dXj+ERf5yhVbsJ3XcdePaAwuDvdya1zr5wtNsQ=";
+    hash = "sha256-5jxGFZqYkhFQ4Rx4jbI+fes9ezsuXa+VZowk5Jzhi3I=";
  };

  vendorHash = "sha256-O6Q9h5zcYAoKLjuzGu7f7UZY0Y5rL2INqFyJT2QZJ/E=";
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (final: {
  pname = "glaze";
-  version = "4.3.0";
+  version = "4.3.1";

  src = fetchFromGitHub {
    owner = "stephenberry";
    repo = "glaze";
    rev = "v${final.version}";
-    hash = "sha256-iFFc2FjcvlQqvjXvFZ+J3RTEIritSM6AZXQlLE5YF9A=";
+    hash = "sha256-AIPsujIJl0LXK6p+GttyjDsXJ0595jl/2Y3adzv2TvE=";
  };

  nativeBuildInputs = [ cmake ];
@@ -5,19 +5,20 @@
  fetchFromGitHub,
  nix-update-script,
  glibcLocales,
+  versionCheckHook,
  withPostgresAdapter ? true,
  withBigQueryAdapter ? true,
 }:
 python3Packages.buildPythonApplication rec {
  pname = "harlequin";
-  version = "1.25.2-unstable-2024-12-30";
+  version = "2.0.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "tconbeer";
    repo = "harlequin";
-    rev = "7ef5327157c7617c1032c9128b487b32d1c91fea";
-    hash = "sha256-QoIjEfQgN6YWDDor4PxfeFkkFGAidUC0ZvHy+PqgnWs=";
+    tag = "v${version}";
+    hash = "sha256-IUzN+rWL69TUUS9npcmfSAPqy/8SYNusNAN/muCMqNI=";
  };

  pythonRelaxDeps = [
@@ -65,15 +66,11 @@ python3Packages.buildPythonApplication rec {
    export HOME=$(mktemp -d)
  '';

-  nativeCheckInputs =
-    [
-      # FIX: restore on next release
-      # versionCheckHook
-    ]
-    ++ (with python3Packages; [
-      pytest-asyncio
-      pytestCheckHook
-    ]);
+  nativeCheckInputs = with python3Packages; [
+    pytest-asyncio
+    pytestCheckHook
+    versionCheckHook
+  ];

  disabledTests =
    [
@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "hcdiag";
-  version = "0.5.5";
+  version = "0.5.6";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = "hcdiag";
    tag = "v${version}";
-    hash = "sha256-ZzSGBw7DRh/VSDtXoMgJpGWVmJUF2G2yZaae+fKklMc=";
+    hash = "sha256-MY1qaVm1PRB3A+MPz4rVUS+Kn4O4p9yzn/3DHKvhZkk=";
  };

-  vendorHash = "sha256-MJg6mqG1bn941LqIr0TQhcgWBCwUtfujdpqf4rgCrWM=";
+  vendorHash = "sha256-09I5Hsw7EhZZAvG7TnJNID/lVv0FVM3ejsmzy3GK48g=";

  nativeInstallCheckHooks = [
    versionCheckHook
@@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "jazz2";
-  version = "3.0.0";
+  version = "3.1.0";

  src = fetchFromGitHub {
    owner = "deathkiller";
    repo = "jazz2-native";
    rev = finalAttrs.version;
-    hash = "sha256-t1bXREL/WWnYnSfCyAY5tus/Bq5V4HVHg9s7oltGoIg=";
+    hash = "sha256-bPVCowop8bocUEXTQI5X4+6FgddKVOMfaXTrbvjrnjI=";
  };

  patches = [ ./nocontent.patch ];
@@ -19,7 +19,7 @@

 rustPlatform.buildRustPackage rec {
  pname = "just";
-  version = "1.38.0";
+  version = "1.39.0";
  outputs =
    [
      "out"
@@ -33,10 +33,10 @@ rustPlatform.buildRustPackage rec {
    owner = "casey";
    repo = pname;
    tag = version;
-    hash = "sha256-jIc8+SFAcH2TsY12+txwlMoJmpDdDpC0H+UrjYH61Lk=";
+    hash = "sha256-K2MUS6wo0qxJnnIWDdmxHRNwyzx1z7yscVwMzXKAwQA=";
  };

-  cargoHash = "sha256-JHLkjMy5b1spJrAqFCCzqgnlYTAKA1Z9Tx4w1WWuiAI=";
+  cargoHash = "sha256-omojDIFfkK1fAxFMe+3B7k6Wfk4/Eaqdv0NcCd8b1ks=";

  nativeBuildInputs =
    lib.optionals (installShellCompletions || installManPages) [ installShellFiles ]
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "kdlfmt";
-  version = "0.0.10";
+  version = "0.0.11";

  src = fetchFromGitHub {
    owner = "hougesen";
    repo = "kdlfmt";
    rev = "v${version}";
-    hash = "sha256-XqcexHeXXVfNoIu0h0Ooxlkm/FaDh/ctkH3cod1mlwY=";
+    hash = "sha256-OldgEAGvwXBnLIEVI/jGXV9lFp/Ua+n8cQqSWETn3T4=";
  };

-  cargoHash = "sha256-ZlaILIVG3gLVFGqv1cozDtbHcL+dxUJXq/DvuJ077O8=";
+  cargoHash = "sha256-Pxs/ITGSU3WErcUgjnehCzuqkeC6M7x2mM/sU00djUw=";

  meta = {
    description = "Formatter for kdl documents";
@@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "kissat";
-  version = "4.0.1";
+  version = "4.0.2";

  src = fetchFromGitHub {
    owner = "arminbiere";
    repo = "kissat";
    rev = "rel-${version}";
-    sha256 = "sha256-+y9TlSEgnMTtRT9F6OBSle9OqGfljChcHOFJ5lgwjyk=";
+    sha256 = "sha256-XVaWO1zHMXM83Qih3HnmIsOvM1zpefF6u9lBP420/mQ=";
  };

  outputs = [
@@ -40,13 +40,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "koboldcpp";
-  version = "1.81.1";
+  version = "1.82.4";

  src = fetchFromGitHub {
    owner = "LostRuins";
    repo = "koboldcpp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Ndi7EQ4Idh946iQuf1mFluLh+9SEfTRtIu8uYN9uHpE=";
+    hash = "sha256-ObQJS6ZRdtSCTAQCq8w3gLDa1Z8z++JgDmyedTXB1F8=";
  };

  enableParallelBuilding = true;
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  preBuild = ''
-    make -C libtools
+    make -C libtools CROSS_COMPILE=${stdenv.cc.targetPrefix}
  '';

  installPhase = ''
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  preBuild = ''
-    make -C libtools
+    make -C libtools CROSS_COMPILE=${stdenv.cc.targetPrefix}
  '';

  installPhase = ''
@@ -1,29 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  rustPlatform,
-}:
-
-rustPlatform.buildRustPackage rec {
-  version = "0.4.1";
-  pname = "loc";
-
-  src = fetchFromGitHub {
-    owner = "cgag";
-    repo = "loc";
-    rev = "v${version}";
-    sha256 = "0086asrx48qlmc484pjz5r5znli85q6qgpfbd81gjlzylj7f57gg";
-  };
-
-  cargoHash = "sha256-/YnU7vLz37Y9gggGx+vKWvtxBH0fjBwXGc+UWyOG2OE=";
-
-  meta = {
-    homepage = "https://github.com/cgag/loc";
-    changelog = "https://github.com/cgag/loc/blob/v${version}/CHANGELOG.md";
-    description = "Count lines of code quickly";
-    mainProgram = "loc";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ sigmanificient ];
-    platforms = lib.platforms.unix;
-  };
-}
@@ -1,7 +1,7 @@
 {
  lib,
  stdenv,
-  libsForQt5,
+  qt6,
  makeDesktopItem,
  copyDesktopItems,
  fetchFromGitHub,
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mcontrolcenter";
-  version = "0.4.1";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "dmitry-s93";
    repo = "MControlCenter";
    rev = finalAttrs.version;
-    hash = "sha256-SV78OVRGzy2zFLT3xqeUtbjlh81Z97PVao18P3h/8dI=";
+    hash = "sha256-Gl+YnbUbwtwF2WHT39bIKh48qSIMe3fpzxgdvifR4DQ=";
  };

  postPatch = ''
@@ -39,14 +39,14 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  nativeBuildInputs = [
-    libsForQt5.wrapQtAppsHook
-    libsForQt5.qttools
+    qt6.wrapQtAppsHook
+    qt6.qttools
    copyDesktopItems
    cmake
  ];

  buildInputs = [
-    libsForQt5.qtbase
+    qt6.qtbase
    kmod
  ];

@@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "memorado";
-  version = "0.4";
+  version = "0.5";

  src = fetchFromGitHub {
    owner = "wbernard";
    repo = "Memorado";
    tag = version;
-    hash = "sha256-yWu2+VAa5FkpLs/KLI0lcNzFLGN/kiq6frtW8SHN+W4=";
+    hash = "sha256-HNZdWRATjSfMk0e99CERPuR891549+wS/WeA7XGFxto=";
  };

  nativeBuildInputs = [
@@ -9,17 +9,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "mountpoint-s3";
-  version = "1.13.0";
+  version = "1.14.0";

  src = fetchFromGitHub {
    owner = "awslabs";
    repo = "mountpoint-s3";
    rev = "v${version}";
-    hash = "sha256-L0xVrADLWVH6r600XvxI5I+IghBSmpC6F93cIH/ejh8=";
+    hash = "sha256-QpJYpHow9/vEPrq82XtbDosGz8lqVB0cOPQmY7Dx78Q=";
    fetchSubmodules = true;
  };

-  cargoHash = "sha256-Uj6/ZDRaYq99gTwHqAX2c21LecC3LLkJXgCDQ+xEytE=";
+  cargoHash = "sha256-lyxuYrmmB1hQCR3fKEMXI69xYcubisRi/bc6M7hQl70=";

  # thread 'main' panicked at cargo-auditable/src/collect_audit_data.rs:77:9:
  # cargo metadata failure: error: none of the selected packages contains these features: libfuse3
@@ -7,16 +7,16 @@
 }:
 buildGo123Module rec {
  pname = "nak";
-  version = "0.9.1";
+  version = "0.10.1";

  src = fetchFromGitHub {
    owner = "fiatjaf";
    repo = "nak";
    tag = "v${version}";
-    hash = "sha256-qfTqzsjRQXrLsL6+qXu2AacDmWbEMH6M1kgSPV3Eodg=";
+    hash = "sha256-nIqmQVLGe6iqgnz0QuCgLTPT0TsL5QUMqxBQGXq13QE=";
  };

-  vendorHash = "sha256-zM9VFLD1CNI9UPvB+ow8KBUDCyoARUqLjumhvWfJvVA=";
+  vendorHash = "sha256-Gt/HG3iRoz9nDBX8C8XUZ0FTic1cl2c5cVkxUG9ngwY=";

  ldflags = [
    "-s"
@@ -5,7 +5,7 @@
 }:
 let
  pname = "nuclear";
-  version = "0.6.41";
+  version = "0.6.42";

  src = fetchurl {
    # Nuclear currenntly only publishes AppImage releases for x86_64, which is hardcoded in
@@ -13,7 +13,7 @@ let
    # provide more arches, we should use stdenv.hostPlatform to determine the arch and choose
    # source URL accordingly.
    url = "https://github.com/nukeop/nuclear/releases/download/v${version}/${pname}-v${version}-x86_64.AppImage";
-    hash = "sha256-hPnFz3cQMQj8EzwqC8bNYf2MidBbLUa8U3I+vQbWpcE=";
+    hash = "sha256-95Q8TEn2gvJu75vgDdzSYH/1ci3BlidQ5nKA53fas6U=";
  };

  appimageContents = appimageTools.extract { inherit pname version src; };
@@ -8,13 +8,13 @@

 buildGoModule {
  pname = "packwiz";
-  version = "0-unstable-2024-10-15";
+  version = "0-unstable-2025-01-19";

  src = fetchFromGitHub {
    owner = "packwiz";
    repo = "packwiz";
-    rev = "0626c00149a8d9a5e9f76e5640e7b8b95c064350";
-    sha256 = "sha256-eAGfLUcyjDR2oJjLK3+DiuICTqoOcIwO5wL350w6vGw=";
+    rev = "241f24b550f6fe838913a56bdd58bac2fc53254a";
+    sha256 = "sha256-VmNsWzsFVNRciNIPUXUVos4cBdpawgN1/nPwMjNpx+0=";
  };
  passthru.updateScript = unstableGitUpdater { };

@@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "podman-tui";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "podman-tui";
    rev = "v${version}";
-    hash = "sha256-3AgPt7dRZaHrM4/y35Z5elBFq1b2ZhvwBd4CKNBbgTk=";
+    hash = "sha256-IO2y+im6QQ6krgYBiFxv9FSU4X6Y+s8/y5/piE1HDSo=";
  };

  vendorHash = null;
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "popeye";
-  version = "0.21.6";
+  version = "0.21.7";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "derailed";
    repo = "popeye";
-    sha256 = "sha256-CX30/AzHFtHhctvLIgRNDBvrXuNUXfz2xLoBY5zIWPo=";
+    sha256 = "sha256-8X/L9je5TaxSx/RtPQlO/6CKd+zUIxFBfTDrNZAA2fU=";
  };

  ldflags = [
@@ -23,7 +23,7 @@ buildGoModule rec {
    "-X github.com/derailed/popeye/cmd.commit=${version}"
  ];

-  vendorHash = "sha256-YvIINp81XPMbSLCDhK9i+I4hfVXPWH19EeVXYhEXbs8=";
+  vendorHash = "sha256-JX9afHS76kUkOdIZZP44UjcZt69YqzW/S1JKhGxLVOw=";

  nativeBuildInputs = [ installShellFiles ];

@@ -25,7 +25,8 @@ let
    inherit src version;
    pname = "portmod-rust";

-    cargoHash = "sha256-sAjgGVVjgXaWbmN/eGEvatYjkHeFTZNX1GXFcJqs3GI=";
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-a6brse/qXzO7H46zUrOJzyOicKPiKGISp2VhdxAVUUI=";

    nativeBuildInputs = [
      python3Packages.python
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "roddhjav-apparmor-rules";
-  version = "0-unstable-2025-01-12";
+  version = "0-unstable-2025-01-25";

  src = fetchFromGitHub {
    owner = "roddhjav";
    repo = "apparmor.d";
-    rev = "f1182b27bb64a3bf44e92a4bafb58178ebfbf5ac";
-    hash = "sha256-3Ofv7Eam2/CXRNM84E0H97RrLWQEzDeSM6wYykzlLAM=";
+    rev = "de690ab878200fe0727571aeb97ff06d08323a64";
+    hash = "sha256-nV8RgielAjYqOGZ/5SpGOupsb770jnrehTn0S1R3hQ4=";
  };

  dontConfigure = true;
@@ -6,13 +6,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "rpl";
-  version = "1.16";
+  version = "1.16.1";

  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-uBpzKYfdGu2j1ZEaw4TN1fH+W9VLrJf7a87vzZBBU3Y=";
+    hash = "sha256-VTm4KU59Yk501tUdVn4z3bFx9Ot00CDL9HGlf44/t44=";
  };

  nativeBuildInputs = [
@@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "rqlite";
-  version = "8.36.5";
+  version = "8.36.8";

  src = fetchFromGitHub {
    owner = "rqlite";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-T5pyec+sS3hBlQTUevIP3v8vlxZEFMSFN7doJliTUCg=";
+    sha256 = "sha256-fyhBKSPE9vAMe1g7IOjrk8u3+KhMgtVrwKRZA+DsGik=";
  };

  vendorHash = "sha256-+otWcVUAqO2e9v+4T5QTw2DOVfDUGu6hP/1/6LO21nY=";
@@ -18,14 +18,14 @@

 stdenv.mkDerivation rec {
  pname = "sbt-extras";
-  rev = "408f74841b90169a7f674955389212e2d02f7f4d";
-  version = "2024-09-28";
+  rev = "e16dab993203b611b9592ddae7b8822a68ae16ec";
+  version = "2024-11-06";

  src = fetchFromGitHub {
    owner = "paulp";
    repo = "sbt-extras";
    inherit rev;
-    sha256 = "2iXNs2Ks54Gj6T6PR5AtWrmR9uUxgFScAfek2v+qdTo=";
+    sha256 = "Z9bN+gmWiomWnp94pMXf5+Bksl6OejIPbYUGfVrDxJQ=";
  };

  dontBuild = true;
@@ -37,7 +37,7 @@

 stdenv.mkDerivation rec {
  pname = "slurm";
-  version = "24.11.0.1";
+  version = "24.11.1.1";

  # N.B. We use github release tags instead of https://www.schedmd.com/downloads.php
  # because the latter does not keep older releases.
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
    repo = "slurm";
    # The release tags use - instead of .
    rev = "${pname}-${builtins.replaceStrings [ "." ] [ "-" ] version}";
-    hash = "sha256-waUCyzLCK3NRp8DfkvzWjGjzlB1MIZ7N9X+nfjrdAFY=";
+    hash = "sha256-0Vev64P0nx0M/fW4XOX/bR92RJNBuQyWggaNeoE6SN0=";
  };

  outputs = [
@@ -3,21 +3,22 @@
  buildGo122Module,
  fetchFromGitHub,
  installShellFiles,
+  versionCheckHook,
  nix-update-script,
 }:

 buildGo122Module rec {
  pname = "sops";
-  version = "3.9.3";
+  version = "3.9.4";

  src = fetchFromGitHub {
    owner = "getsops";
    repo = pname;
    tag = "v${version}";
-    hash = "sha256-U8ZJktOSj0JJ70CbXDS3FpNmk07cKnco5w2rt4BnQBU=";
+    hash = "sha256-w2RMK1Fl/k8QXV68j0Kc6shtx4vQa07RCnpgHLM8c8Q=";
  };

-  vendorHash = "sha256-+UxngJgKG+gAjnXXEcdXPXQqRcMfRDn4wPeR1IhltC0=";
+  vendorHash = "sha256-wxmSj3QaFChGE+/2my7Oe2mhprwi404izUxteecyggY=";

  postPatch = ''
    substituteInPlace go.mod \
@@ -32,8 +33,6 @@ buildGo122Module rec {
    "-X github.com/getsops/sops/v3/version.Version=${version}"
  ];

-  passthru.updateScript = nix-update-script { };
-
  nativeBuildInputs = [ installShellFiles ];

  postInstall = ''
@@ -41,15 +40,21 @@ buildGo122Module rec {
    installShellCompletion --cmd sops --zsh ${./zsh_autocomplete}
  '';

-  meta = with lib; {
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
    homepage = "https://getsops.io/";
    description = "Simple and flexible tool for managing secrets";
    changelog = "https://github.com/getsops/sops/blob/v${version}/CHANGELOG.rst";
    mainProgram = "sops";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
      Scrumplex
      mic92
    ];
-    license = licenses.mpl20;
+    license = lib.licenses.mpl20;
  };
 }
@@ -14,6 +14,10 @@
  soapysdr-with-plugins,
  libbladeRF,
  zeromq,
+  enableAvx ? stdenv.hostPlatform.avxSupport,
+  enableAvx2 ? stdenv.hostPlatform.avx2Support,
+  enableFma ? stdenv.hostPlatform.fmaSupport,
+  enableAvx512 ? stdenv.hostPlatform.avx512Support,
 }:

 stdenv.mkDerivation rec {
@@ -27,6 +31,11 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-3cQMZ75I4cyHpik2d/eBuzw7M4OgbKqroCddycw4uW8=";
  };

+  outputs = [
+    "out"
+    "dev"
+  ];
+
  nativeBuildInputs = [
    cmake
    pkg-config
@@ -45,7 +54,17 @@ stdenv.mkDerivation rec {
    zeromq
  ];

-  cmakeFlags = [ "-DENABLE_WERROR=OFF" ];
+  cmakeFlags = [
+    "-DENABLE_WERROR=OFF"
+    (lib.cmakeBool "ENABLE_AVX" enableAvx)
+    (lib.cmakeBool "ENABLE_AVX2" enableAvx2)
+    (lib.cmakeBool "ENABLE_FMA" enableFma)
+    (lib.cmakeBool "ENABLE_AVX512" enableAvx512)
+  ];
+
+  postInstall = lib.optionalString (!stdenv.hostPlatform.isStatic) ''
+    rm $out/lib/*.a
+  '';

  meta = with lib; {
    homepage = "https://www.srslte.com/";
@@ -1,50 +1,137 @@
 {
+  buildGoModule,
+  fetchFromGitHub,
+  fetchYarnDeps,
  lib,
+  nixosTests,
+  nodejs,
+  stash,
  stdenv,
-  fetchurl,
+  testers,
+  yarnBuildHook,
+  yarnConfigHook,
 }:
 let
-
-  version = "0.25.1";
-
-  sources = {
-    x86_64-linux = {
-      url = "https://github.com/stashapp/stash/releases/download/v${version}/stash-linux";
-      hash = "sha256-Rb4x6iKx6T9NPuWWDbNaz+35XPzLqZzSm0psv+k2Gw4=";
-    };
-    aarch64-linux = {
-      url = "https://github.com/stashapp/stash/releases/download/v${version}/stash-linux-arm64v8";
-      hash = "sha256-6qPyIYKFkhmBNO47w9E91FSKlByepBOnl0MNJighGSc=";
-    };
-    x86_64-darwin = {
-      url = "https://github.com/stashapp/stash/releases/download/v${version}/stash-macos";
-      hash = "sha256-W8+rgqWUDTOB8ykGO2GL9tKEjaDXdx9LpFg0TAtJsxM=";
-    };
-  };
-in
-stdenv.mkDerivation (finalAttrs: {
-  inherit version;
+  inherit (lib.importJSON ./version.json)
+    gitHash
+    srcHash
+    vendorHash
+    version
+    yarnHash
+    ;

  pname = "stash";

-  src = fetchurl { inherit (sources.${stdenv.system}) url hash; };
+  src = fetchFromGitHub {
+    owner = "stashapp";
+    repo = "stash";
+    tag = "v${version}";
+    hash = srcHash;
+  };

-  dontUnpack = true;
+  frontend = stdenv.mkDerivation (final: {
+    inherit version;
+    pname = "${pname}-ui";
+    src = "${src}/ui/v2.5";

-  installPhase = ''
-    runHook preInstall
+    yarnOfflineCache = fetchYarnDeps {
+      yarnLock = "${final.src}/yarn.lock";
+      hash = yarnHash;
+    };

-    install -Dm755 $src $out/bin/stash
+    nativeBuildInputs = [
+      yarnConfigHook
+      yarnBuildHook
+      # Needed for executing package.json scripts
+      nodejs
+    ];

-    runHook postInstall
+    postPatch = ''
+      substituteInPlace codegen.ts \
+        --replace-fail "../../graphql/" "${src}/graphql/"
+    '';
+
+    buildPhase = ''
+      runHook preBuild
+
+      export HOME=$(mktemp -d)
+      export VITE_APP_DATE='1970-01-01 00:00:00'
+      export VITE_APP_GITHASH=${gitHash}
+      export VITE_APP_STASH_VERSION=v${version}
+      export VITE_APP_NOLEGACY=true
+
+      yarn --offline run gqlgen
+      yarn --offline build
+
+      mv build $out
+
+      runHook postBuild
+    '';
+
+    dontInstall = true;
+    dontFixup = true;
+  });
+in
+buildGoModule {
+  inherit
+    pname
+    src
+    version
+    vendorHash
+    ;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X 'github.com/stashapp/stash/internal/build.buildstamp=1970-01-01 00:00:00'"
+    "-X 'github.com/stashapp/stash/internal/build.githash=${gitHash}'"
+    "-X 'github.com/stashapp/stash/internal/build.version=v${version}'"
+    "-X 'github.com/stashapp/stash/internal/build.officialBuild=false'"
+  ];
+  tags = [
+    "sqlite_stat4"
+    "sqlite_math_functions"
+  ];
+
+  subPackages = [ "cmd/stash" ];
+
+  preBuild = ''
+    cp -a ${frontend} ui/v2.5/build
+    # `go mod tidy` requires internet access and does nothing
+    echo "skip_mod_tidy: true" >> gqlgen.yml
+    # remove `-trimpath` fron `GOFLAGS` because `gqlgen` does not work with it
+    GOFLAGS="''${GOFLAGS/-trimpath/}" go generate ./cmd/stash
  '';

-  meta = with lib; {
-    description = "Stash is a self-hosted porn app";
-    homepage = "https://github.com/stashapp/stash";
-    license = licenses.agpl3Only;
-    maintainers = with maintainers; [ Golo300 ];
-    platforms = builtins.attrNames sources;
-    mainProgram = "stash";
+  strictDeps = true;
+
+  passthru = {
+    inherit frontend;
+    updateScript = ./update.py;
+    tests = {
+      inherit (nixosTests) stash;
+      version = testers.testVersion {
+        package = stash;
+        version = "v${version} (${gitHash}) - Unofficial Build - 1970-01-01 00:00:00";
+      };
+    };
  };
-})
+
+  meta = {
+    mainProgram = "stash";
+    description = "Organizer for your adult videos/images";
+    license = lib.licenses.agpl3Only;
+    homepage = "https://stashapp.cc/";
+    changelog = "https://github.com/stashapp/stash/blob/v${version}/ui/v2.5/src/docs/en/Changelog/v${lib.versions.major version}${lib.versions.minor version}0.md";
+    maintainers = with lib.maintainers; [
+      Golo300
+      DrakeTDL
+    ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
+  };
+}
@@ -0,0 +1,82 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i python3 -p python3 prefetch-yarn-deps nix-prefetch-git nix-prefetch
+
+from pathlib import Path
+from shutil import copyfile
+from urllib.request import Request, urlopen
+import json
+import os
+import subprocess
+
+
+def run_external(args: list[str]):
+    proc = subprocess.run(
+        args,
+        check=True,
+        stdout=subprocess.PIPE,
+    )
+
+    return proc.stdout.strip().decode("utf8")
+
+def get_latest_release_tag():
+    req = Request("https://api.github.com/repos/stashapp/stash/tags?per_page=1")
+
+    if "GITHUB_TOKEN" in os.environ:
+        req.add_header("authorization", f"Bearer {os.environ['GITHUB_TOKEN']}")
+
+    with urlopen(req) as resp:
+        return json.loads(resp.read())[0]
+
+def prefetch_github(rev: str):
+    print(f"Prefetching stashapp/stash({rev})")
+
+    proc = run_external(["nix-prefetch-git", "--no-deepClone", "--rev", rev, f"https://github.com/stashapp/stash"])
+
+    return json.loads(proc)
+
+def prefetch_yarn(lock_file: str):
+    print(f"Prefetching yarn deps")
+
+    hash = run_external(["prefetch-yarn-deps", lock_file])
+
+    return run_external(["nix", "hash", "convert", "--hash-algo", "sha256", hash])
+
+def prefetch_go_modules(src: str, version: str):
+    print(f"Prefetching go modules")
+    expr = fr"""
+        {{ sha256 }}: (buildGoModule {{
+            pname = "stash";
+            src = {src};
+            version = "{version}";
+            vendorHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+        }}).goModules.overrideAttrs (_: {{ modSha256 = sha256; }})
+    """
+    return run_external([
+        "nix-prefetch",
+        "--option",
+        "extra-experimental-features",
+        "flakes",
+        expr
+    ])
+
+
+def save_version_json(version: dict[str, str]):
+    print("Writing version.json")
+    with open(Path(__file__).parent / "version.json", 'w') as f:
+        json.dump(version, f, indent=2)
+        f.write("\n")
+
+if __name__ == "__main__":
+    release = get_latest_release_tag()
+
+    src = prefetch_github(release['name'])
+
+    yarn_hash = prefetch_yarn(f"{src['path']}/ui/v2.5/yarn.lock")
+
+    save_version_json({
+        "version": release["name"][1:],
+        "gitHash": release["commit"]["sha"][:8],
+        "srcHash": src["hash"],
+        "yarnHash": yarn_hash,
+        "vendorHash": prefetch_go_modules(src["path"], release["name"][1:])
+    })
@@ -0,0 +1,7 @@
+{
+  "version": "0.27.2",
+  "gitHash": "76648fee",
+  "srcHash": "sha256-SMZBDKqgVdXf2abaSf/FuG2Vodav7SBu6onjHFZIZIM=",
+  "yarnHash": "sha256-ufGYQfEbcXO3XhpDQ3UTofS5B31L427KWy5NPbWhBJo=",
+  "vendorHash": "sha256-ZtKKs0JCEe4OpPulO74qYTYrZu2Ds3prWp5N8UP6z0g="
+}
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "tlsx";
-  version = "1.1.8";
+  version = "1.1.9";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "tlsx";
    tag = "v${version}";
-    hash = "sha256-AQiwHNHfwOJYIEsFm2YiksdTUxp5vkCL80rpvxHY2rA=";
+    hash = "sha256-u83hPmmiXH7SGCyINkHFrjNDLanwJLf0o9ZyceQeSg0=";
  };

-  vendorHash = "sha256-KNyB+xK7TUf7XoVX/4xBTnG2lMMPVV5AOoUNi4aA/cM=";
+  vendorHash = "sha256-NF05vVLBRlWQpmTfrNEjnvH7kZMhgY73xmSgTZ8FGmo=";

  ldflags = [
    "-s"
@@ -7,21 +7,23 @@

 buildGo123Module rec {
  pname = "traefik";
-  version = "3.2.2";
+  version = "3.3.2";

  # Archive with static assets for webui
  src = fetchzip {
    url = "https://github.com/traefik/traefik/releases/download/v${version}/traefik-v${version}.src.tar.gz";
-    hash = "sha256-DTgpoJvk/rxzMAIBgKJPT70WW8W/aBhOEoyw3cK+JrM=";
+    hash = "sha256-7qS+rOBYDyYI8t0rVNmM0sJjGSdtIVelaIJuW1jaL+g=";
    stripRoot = false;
  };

-  vendorHash = "sha256-+sL0GJhWMlFdNEsRdgRJ42aGedOfn76gg70wH6/a+qQ=";
+  vendorHash = "sha256-9WuhQjl+lWRZBvEP8qjBQUbEQC1SG9J+3xNpmIieOo8=";

  subPackages = [ "cmd/traefik" ];

+  env.CGO_ENABLED = 0;
+
  preBuild = ''
-    GOOS= GOARCH= CGO_ENABLED=0 go generate
+    GOOS= GOARCH= go generate

    CODENAME=$(grep -Po "CODENAME \?=\s\K.+$" Makefile)

@@ -7,11 +7,11 @@

 appimageTools.wrapType2 rec {
  pname = "tutanota-desktop";
-  version = "259.241223.2";
+  version = "259.250108.1";

  src = fetchurl {
    url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/tutanota-desktop-linux.AppImage";
-    hash = "sha256-VeAXOCdvy9liCJBNMdPc6iIeuOutqQ9sShc4XytApH4=";
+    hash = "sha256-VXHhN+6k1Jd/4tPxxLwXNYYPjpl+yBn8gRDLlfvCS4g=";
  };

  extraPkgs = pkgs: [ pkgs.libsecret ];
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "unpoller";
-  version = "2.14.0";
+  version = "2.14.1";

  src = fetchFromGitHub {
    owner = "unpoller";
    repo = "unpoller";
    rev = "v${version}";
-    hash = "sha256-2yDrnBi5ZaFfgpqZS1PZM3Fp3zqb5oMuMbsoAeZan8o=";
+    hash = "sha256-x3Uboa6bs59LafEF9/aYmudo9JIh3KIMNdLJRimcmxY=";
  };

  vendorHash = "sha256-ZylkCictJNJ/QrWEbBIXDEKElpZRw2Yrj/IHMx0lqg0=";
@@ -14,19 +14,19 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "vencord";
-  version = "1.10.9";
+  version = "1.11.2";

  src = fetchFromGitHub {
    owner = "Vendicated";
    repo = "Vencord";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-sU2eJUUw7crvzMGGBQP6rbxISkL+S5nmT3QspyYXlRQ=";
+    hash = "sha256-18CzWAcBotIdzXFPIptBo20KZxXDVhM7AwwlCnPz+Wk=";
  };

  pnpmDeps = pnpm_9.fetchDeps {
    inherit (finalAttrs) pname src;

-    hash = "sha256-vVzERis1W3QZB/i6SQR9dQR56yDWadKWvFr+nLTQY9Y=";
+    hash = "sha256-ZUwtNtOmxjhOBpYB7vuytunGBRSuVxdlQsceRmeyhhI=";
  };

  nativeBuildInputs = [
@@ -21,11 +21,11 @@

 stdenv.mkDerivation rec {
  pname = "vintagestory";
-  version = "1.19.8";
+  version = "1.20.3";

  src = fetchurl {
    url = "https://cdn.vintagestory.at/gamefiles/stable/vs_client_linux-x64_${version}.tar.gz";
-    hash = "sha256-R6J+ACYDQpOzJZFBizsQGOexR7lMyeoZqz9TnWxfwyM=";
+    hash = "sha256-+nEyFlLfTAOmd8HrngZOD1rReaXCXX/ficE/PCLcewg=";
  };

  nativeBuildInputs = [
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "wayidle";
-  version = "0.2.0";
+  version = "1.0.0";

  src = fetchFromSourcehut {
    owner = "~whynothugo";
    repo = "wayidle";
    rev = "v${version}";
-    hash = "sha256-7hFk/YGOQ5+gQy6pT5DRgMLThQ1vFAvUvdHekTyzIRU=";
+    hash = "sha256-DgsktRIGWswSBYeij5OL4nJwWaURv+v+qzOdZnLKG/E=";
  };

-  cargoHash = "sha256-PohfLmUoK+2a7Glnje4Rbym2rvzydUJAYW+edOj7qeo=";
+  cargoHash = "sha256-fJXI2y+kUIAwW6QrMf/T/2N6v/OY9BD3g9oXwB7U4so=";

  meta = with lib; {
    description = "Execute a program when a Wayland compositor reports being N seconds idle";
@@ -0,0 +1,199 @@
+{
+  lib,
+  stdenv,
+  cmake,
+  apple-sdk_11,
+  ninja,
+  fetchFromGitHub,
+  SDL2,
+  wget,
+  which,
+  autoAddDriverRunpath,
+  makeWrapper,
+
+  metalSupport ? stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64,
+  coreMLSupport ? stdenv.hostPlatform.isDarwin && false, # FIXME currently broken
+
+  config,
+  cudaSupport ? config.cudaSupport,
+  cudaPackages ? { },
+
+  rocmSupport ? config.rocmSupport,
+  rocmPackages ? { },
+  rocmGpuTargets ? builtins.concatStringsSep ";" rocmPackages.clr.gpuTargets,
+
+  vulkanSupport ? false,
+  shaderc,
+  vulkan-headers,
+  vulkan-loader,
+
+  withSDL ? true,
+}:
+
+assert metalSupport -> stdenv.hostPlatform.isDarwin;
+assert coreMLSupport -> stdenv.hostPlatform.isDarwin;
+
+let
+  # It's necessary to consistently use backendStdenv when building with CUDA support,
+  # otherwise we get libstdc++ errors downstream.
+  # cuda imposes an upper bound on the gcc version, e.g. the latest gcc compatible with cudaPackages_11 is gcc11
+  effectiveStdenv = if cudaSupport then cudaPackages.backendStdenv else stdenv;
+  inherit (lib)
+    cmakeBool
+    cmakeFeature
+    optional
+    optionals
+    optionalString
+    forEach
+    ;
+
+  darwinBuildInputs = [ apple-sdk_11 ];
+
+  cudaBuildInputs = with cudaPackages; [
+    cuda_cccl # <nv/target>
+
+    # A temporary hack for reducing the closure size, remove once cudaPackages
+    # have stopped using lndir: https://github.com/NixOS/nixpkgs/issues/271792
+    cuda_cudart
+    libcublas
+  ];
+
+  rocmBuildInputs = with rocmPackages; [
+    clr
+    hipblas
+    rocblas
+  ];
+
+  vulkanBuildInputs = [
+    shaderc
+    vulkan-headers
+    vulkan-loader
+  ];
+
+in
+effectiveStdenv.mkDerivation (finalAttrs: {
+  pname = "whisper-cpp";
+  version = "1.7.2";
+
+  src = fetchFromGitHub {
+    owner = "ggerganov";
+    repo = "whisper.cpp";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-y30ZccpF3SCdRGa+P3ddF1tT1KnvlI4Fexx81wZxfTk=";
+  };
+
+  # The upstream download script tries to download the models to the
+  # directory of the script, which is not writable due to being
+  # inside the nix store. This patch changes the script to download
+  # the models to the current directory of where it is being run from.
+  patches = [ ./download-models.patch ];
+
+  postPatch = ''
+    for target in examples/{bench,command,main,quantize,server,stream,talk}/CMakeLists.txt; do
+      if ! grep -q -F 'install('; then
+        echo 'install(TARGETS ''${TARGET} RUNTIME)' >> $target
+      fi
+    done
+  '';
+
+  nativeBuildInputs =
+    [
+      cmake
+      ninja
+      which
+      makeWrapper
+    ]
+    ++ lib.optionals cudaSupport [
+      cudaPackages.cuda_nvcc
+      autoAddDriverRunpath
+    ];
+
+  buildInputs =
+    optional withSDL SDL2
+    ++ optionals effectiveStdenv.hostPlatform.isDarwin darwinBuildInputs
+    ++ optionals cudaSupport cudaBuildInputs
+    ++ optionals rocmSupport rocmBuildInputs
+    ++ optionals vulkanSupport vulkanBuildInputs;
+
+  cmakeFlags =
+    [
+      (cmakeBool "WHISPER_BUILD_EXAMPLES" true)
+      (cmakeBool "GGML_CUDA" cudaSupport)
+      (cmakeBool "GGML_HIPBLAS" rocmSupport)
+      (cmakeBool "GGML_VULKAN" vulkanSupport)
+      (cmakeBool "WHISPER_SDL2" withSDL)
+      (cmakeBool "GGML_LTO" true)
+      (cmakeBool "GGML_NATIVE" false)
+      (cmakeBool "BUILD_SHARED_LIBS" (!effectiveStdenv.hostPlatform.isStatic))
+    ]
+    ++ optionals (effectiveStdenv.hostPlatform.isx86 && !effectiveStdenv.hostPlatform.isStatic) [
+      (cmakeBool "GGML_BACKEND_DL" true)
+      (cmakeBool "GGML_CPU_ALL_VARIANTS" true)
+    ]
+    ++ optionals cudaSupport [
+      (cmakeFeature "CMAKE_CUDA_ARCHITECTURES" cudaPackages.flags.cmakeCudaArchitecturesString)
+    ]
+    ++ optionals rocmSupport [
+      (cmakeFeature "CMAKE_C_COMPILER" "hipcc")
+      (cmakeFeature "CMAKE_CXX_COMPILER" "hipcc")
+
+      # Build all targets supported by rocBLAS. When updating search for TARGET_LIST_ROCM
+      # in https://github.com/ROCmSoftwarePlatform/rocBLAS/blob/develop/CMakeLists.txt
+      # and select the line that matches the current nixpkgs version of rocBLAS.
+      "-DAMDGPU_TARGETS=${rocmGpuTargets}"
+    ]
+    ++ optionals coreMLSupport [
+      (cmakeBool "WHISPER_COREML" true)
+      (cmakeBool "WHISPER_COREML_ALLOW_FALLBACK" true)
+    ]
+    ++ optionals metalSupport [
+      (cmakeFeature "CMAKE_C_FLAGS" "-D__ARM_FEATURE_DOTPROD=1")
+      (cmakeBool "GGML_METAL" true)
+      (cmakeBool "GGML_METAL_EMBED_LIBRARY" true)
+    ];
+
+  postInstall = ''
+    # Add "whisper-cpp" prefix before every command
+    mv -v $out/bin/{main,whisper-cpp}
+
+    for file in $out/bin/*; do
+      if [[ -x "$file" && -f "$file" && "$(basename $file)" != "whisper-cpp" ]]; then
+        mv -v "$file" "$out/bin/whisper-cpp-$(basename $file)"
+      fi
+    done
+
+    install -v -D -m755 $src/models/download-ggml-model.sh $out/bin/whisper-cpp-download-ggml-model
+
+    wrapProgram $out/bin/whisper-cpp-download-ggml-model \
+      --prefix PATH : ${lib.makeBinPath [ wget ]}
+  '';
+
+  requiredSystemFeatures = optionals rocmSupport [ "big-parallel" ]; # rocmSupport multiplies build time by the number of GPU targets, which takes arround 30 minutes on a 16-cores system to build
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/whisper-cpp --help >/dev/null
+    runHook postInstallCheck
+  '';
+
+  meta = {
+    description = "Port of OpenAI's Whisper model in C/C++";
+    longDescription = ''
+      To download the models as described in the project's readme, you may
+      use the `whisper-cpp-download-ggml-model` binary from this package.
+    '';
+    homepage = "https://github.com/ggerganov/whisper.cpp";
+    license = lib.licenses.mit;
+    mainProgram = "whisper-cpp";
+    platforms = lib.platforms.all;
+    broken = coreMLSupport;
+    badPlatforms = optionals cudaSupport lib.platforms.darwin;
+    maintainers = with lib.maintainers; [
+      dit7ya
+      hughobrien
+      aviallon
+    ];
+  };
+})
@@ -5,12 +5,12 @@
 }:

 stdenv.mkDerivation rec {
-  version = "3.8";
+  version = "3.10";
  pname = "xtermcontrol";

  src = fetchurl {
    url = "https://thrysoee.dk/xtermcontrol/xtermcontrol-${version}.tar.gz";
-    sha256 = "sha256-Vh6GNiDkjNhaD9U/3fG2LpMLN39L3jRUgG/FQeG1z40=";
+    sha256 = "sha256-Prl7HZ2KrhutT+LEHKOj27ENLWfmykWZqh9jGkBQPe4=";
  };

  meta = {
@@ -49,7 +49,6 @@ rustPlatform.buildRustPackage rec {
    clang
  ];

-  cargoHash = "sha256-gZdLThmaeWVJXoeG7fuusfacgH2RNTHrqm8W0kqkqOY=";
  cargoLock.lockFile = ./Cargo.lock;

  # xtask doesn't support passing --target, but nix hooks expect the folder structure from when it's set
@@ -14,7 +14,7 @@ mkCoqDerivation {
    with lib.versions;
    lib.switch coq.version [
      {
-        case = range "8.14" "8.20";
+        case = range "8.14" "9.0";
        out = "20230107";
      }
      {
@@ -14,7 +14,7 @@ mkCoqDerivation {
    with lib.versions;
    lib.switch coq.version [
      {
-        case = range "8.14" "8.20";
+        case = range "8.14" "9.0";
        out = "1.8.5";
      }
      {
@@ -25,7 +25,7 @@ mkCoqDerivation {
      [
        {
          cases = [
-            (range "8.17" "8.20")
+            (range "8.17" "9.0")
            (range "1.3.1" "1.3.2")
          ];
          out = "0.1.0";
@@ -4,7 +4,7 @@ mkCoqDerivation rec {
  pname = "coq-ext-lib";
  inherit version;
  defaultVersion = with lib.versions; lib.switch coq.coq-version [
-    { case = range "8.14" "8.20"; out = "0.13.0"; }
+    { case = range "8.14" "9.0"; out = "0.13.0"; }
    { case = range "8.11" "8.19"; out = "0.12.0"; }
    { case = range "8.8" "8.16"; out = "0.11.6"; }
    { case = range "8.8" "8.14"; out = "0.11.4"; }
@@ -14,7 +14,7 @@ mkCoqDerivation rec {
  defaultVersion =
    with lib.versions;
    lib.switch coq.version [
-      { case = range "8.13" "8.20"; out = "5.2.0+20241009"; }
+      { case = range "8.13" "9.0"; out = "5.2.0+20241009"; }
      { case = range "8.10" "8.16"; out = "4.0.0"; }
    ] null;
  release."5.2.0+20241009".sha256 = "sha256-eg47YgnIonCq7XOUgh9uzoKsuFCvsOSTZhgFLNNcPD0=";
@@ -14,7 +14,7 @@ mkCoqDerivation {
    with lib.versions;
    lib.switch coq.version [
      {
-        case = range "8.9" "8.20";
+        case = range "8.9" "9.0";
        out = "20230107";
      }
      {
@@ -16,7 +16,7 @@ let
      with lib.versions;
      lib.switch coq.coq-version [
        {
-          case = range "8.12" "8.20";
+          case = range "8.12" "9.0";
          out = "20240715";
        }
        {
@@ -35,11 +35,11 @@ let
    };
    propagatedBuildInputs = [ stdlib ];
    preBuild = "cd coq-menhirlib/src";
-    meta = with lib; {
+    meta = {
      homepage = "https://gitlab.inria.fr/fpottier/menhir/-/tree/master/coq-menhirlib";
      description = "A support library for verified Coq parsers produced by Menhir";
-      license = licenses.lgpl3Plus;
-      maintainers = with maintainers; [ ];
+      license = lib.licenses.lgpl3Plus;
+      maintainers = with lib.maintainers; [ damhiya ];
    };
  };
 in
@@ -21,7 +21,7 @@ in
      [
        {
          cases = [
-            (lib.versions.range "8.15" "8.20")
+            (lib.versions.range "8.15" "9.0")
            lib.pred.true
          ];
          out = "2.0.4";
@@ -14,7 +14,7 @@ mkCoqDerivation {
    with lib.versions;
    lib.switch coq.coq-version [
      {
-        case = range "8.9" "8.20";
+        case = range "8.9" "9.0";
        out = "20230107";
      }
      {
@@ -20,7 +20,7 @@ mkCoqDerivation {
    with lib.versions;
    lib.switch coq.coq-version [
      {
-        case = range "8.14" "8.20";
+        case = range "8.14" "9.0";
        out = "1.9";
      }
      {
@@ -13,6 +13,10 @@ mkCoqDerivation {
  defaultVersion =
    with lib.versions;
    lib.switch coq.coq-version [
+      {
+        case = range "9.0" "9.0";
+        out = "9.0.0+rocq${coq.coq-version}";
+      }
      {
        case = range "8.13" "8.20";
        out = "9.0.0+coq${coq.coq-version}";
@@ -23,6 +27,7 @@ mkCoqDerivation {
      }
    ] null;

+  release."9.0.0+rocq9.0".sha256 = "sha256-ctnwpyNVhryEUA5YEsAImrcJsNMhtBgDSOz+z5Z4R78=";
  release."9.0.0+coq8.20".sha256 = "sha256-pkvyDaMXRalc6Uu1eBTuiqTpRauRrzu946c6TavyTKY=";
  release."9.0.0+coq8.19".sha256 = "sha256-02uL+qWbUveHe67zKfc8w3U0iN3X2DKBsvP3pKpW8KQ=";
  release."9.0.0+coq8.18".sha256 = "sha256-vLeJ0GNKl4M84Uj2tAwlrxJOSR6VZoJQvdlDhxJRge8=";
@@ -17,7 +17,7 @@ mkCoqDerivation {
    with lib.versions;
    lib.switch coq.version [
      {
-        case = range "8.14" "8.20";
+        case = range "8.14" "9.0";
        out = "0.4.1";
      }
      {
@@ -21,6 +21,7 @@ default-elpi-version = if elpi-version != null then elpi-version else (
    { case = "8.18"; out = "1.18.1"; }
    { case = "8.19"; out = "1.18.1"; }
    { case = "8.20"; out = "1.19.2"; }
+    { case = "9.0"; out = "2.0.7"; }
  ] { }
 );
 elpi = coq.ocamlPackages.elpi.override { version = default-elpi-version; };
@@ -34,6 +35,7 @@ derivation = mkCoqDerivation {
  owner = "LPCIC";
  inherit version;
  defaultVersion = lib.switch coq.coq-version [
+    { case = "9.0"; out = "2.4.0"; }
    { case = "8.20"; out = "2.2.0"; }
    { case = "8.19"; out = "2.0.1"; }
    { case = "8.18"; out = "2.0.0"; }
@@ -45,6 +47,7 @@ derivation = mkCoqDerivation {
    { case = "8.12"; out = "1.8.3_8.12"; }
    { case = "8.11"; out = "1.6.3_8.11"; }
  ] null;
+  release."2.4.0".sha256 = "sha256-W2+vVGExLLux8e0nSZESSoMVvrLxhL6dmXkb+JuKiqc=";
  release."2.2.0".sha256 = "sha256-rADEoqTXM7/TyYkUKsmCFfj6fjpWdnZEOK++5oLfC/I=";
  release."2.0.1".sha256 = "sha256-cuoPsEJ+JRLVc9Golt2rJj4P7lKltTrrmQijjoViooc=";
  release."2.0.0".sha256 = "sha256-A/cH324M21k3SZ7+YWXtaYEbu6dZQq3K0cb1RMKjbsM=";
@@ -13,7 +13,7 @@ mkCoqDerivation rec {
    with lib.versions;
    lib.switch coq.coq-version [
      {
-        case = range "8.10" "8.20";
+        case = range "8.10" "9.0";
        out = "0.3.4";
      }
    ] null;
@@ -17,7 +17,7 @@ mkCoqDerivation rec {
  inherit (coq) src;
  release."${coq.version}" = { };

-  defaultVersion = if lib.versions.isGe "8.14" coq.version then coq.version else null;
+  defaultVersion = if lib.versions.range "8.14" "8.20" coq.version then coq.version else null;

  preConfigure = ''
    patchShebangs dev/tools/
@@ -18,7 +18,7 @@ mkCoqDerivation {
      [
        {
          cases = [
-            (range "8.17" "8.20")
+            (range "8.17" "9.0")
            (isGe "2.0.0")
          ];
          out = "0.2.1";
@@ -19,7 +19,7 @@
      [
        {
          cases = [
-            (range "8.17" "8.20")
+            (range "8.17" "9.0")
            (isGe "2.0.0")
          ];
          out = "0.5.0";
@@ -26,7 +26,7 @@ mkCoqDerivation {
      [
        {
          cases = [
-            (range "8.16" "8.20")
+            (range "8.16" "9.0")
            (range "2.0" "2.3")
          ];
          out = "2.2";
@@ -5,6 +5,7 @@ let hb = mkCoqDerivation {
  owner = "math-comp";
  inherit version;
  defaultVersion = with lib.versions; lib.switch coq.coq-version [
+    { case = range "9.0" "9.0";   out = "1.8.1"; }
    { case = range "8.19" "8.20"; out = "1.8.0"; }
    { case = range "8.18" "8.20"; out = "1.7.1"; }
    { case = range "8.16" "8.18"; out = "1.6.0"; }
@@ -14,6 +15,7 @@ let hb = mkCoqDerivation {
    { case = range "8.12" "8.13"; out = "1.1.0"; }
    { case = isEq "8.11";         out = "0.10.0"; }
  ] null;
+  release."1.8.1".sha256  = "sha256-Z0WAHDyycqgL+Le/zNfEAoLWzFb7WIL+3G3vEBExlb4=";
  release."1.8.0".sha256  = "sha256-4s/4ZZKj5tiTtSHGIM8Op/Pak4Vp52WVOpd4l9m19fY=";
  release."1.7.1".sha256  = "sha256-MCmOzMh/SBTFAoPbbIQ7aqd3hMcSMpAKpiZI7dbRaGs=";
  release."1.7.0".sha256  = "sha256-WqSeuJhmqicJgXw/xGjGvbRzfyOK7rmkVRb6tPDTAZg=";
@@ -15,7 +15,7 @@ mkCoqDerivation rec {
    with lib.versions;
    lib.switch coq.coq-version [
      {
-        case = range "8.19" "8.20";
+        case = range "8.19" "9.0";
        out = "4.3.0";
      }
      {
@@ -19,7 +19,7 @@
    in
    lib.switch coq.coq-version [
      {
-        case = range "8.14" "8.20";
+        case = range "8.14" "9.0";
        out = "0.2.0";
      }
      {
@@ -24,10 +24,10 @@ mkCoqDerivation {
      [
        {
          cases = [
-            (range "8.16" "8.20")
+            (range "8.16" "9.0")
            (isGe "2.0")
          ];
-          out = "1.2.3";
+          out = "1.2.4";
        }
        {
          cases = [
@@ -57,6 +57,7 @@ mkCoqDerivation {
  release."1.1.1".sha256 = "sha256-5wItMeeTRoJlRBH3zBNc2VUZn6pkDde60YAvXTx+J3U=";
  release."1.2.2".sha256 = "sha256-EU9RJGV3BvnmsX+mGH+6+MDXiGHgDI7aP5sIYiMUXTs=";
  release."1.2.3".sha256 = "sha256-6uc1VEfDv+fExEfBR2c0/Q/KjrkX0TbEMCLgeYcpkls=";
+  release."1.2.4".sha256 = "sha256-BRxt0LGPz2u3kJRjcderaZqCfs8M8qKAAwNSWmIck7Q=";

  propagatedBuildInputs = [
    mathcomp-algebra
@@ -18,14 +18,15 @@ mkCoqDerivation {
  release = {
    "1.0.0".sha256 = "10g0gp3hk7wri7lijkrqna263346wwf6a3hbd4qr9gn8hmsx70wg";
    "1.0.1".sha256 = "sha256:02f4dv4rz72liciwxb2k7acwx6lgqz4381mqyq5854p3nbyn06aw";
+    "1.0.2".sha256 = "sha256-fJ/5xr91VtvpIoaFwb3PlnKl6UHG6GEeBRVGZrVLMU0=";
  };
  inherit version;
  defaultVersion =
    with lib.versions;
    lib.switch coq.version [
      {
-        case = range "8.10" "8.20";
-        out = "1.0.1";
+        case = range "8.10" "9.0";
+        out = "1.0.2";
      }
      {
        case = range "8.5" "8.14";
--- a/Show More
+++ b/Show More